Markdown Browser

Wrapper skill for OpenClaw web_fetch results. Use when you need MECE post-processing on fetched pages: policy decision from Content-Signal, privacy redaction...

This skill appears to do what it says: normalize web_fetch output, redact obvious query param secrets, parse Content-Signal, and convert HTML to Markdown using the 'turndown' library. The main risk is the install step: package-lock.json resolves dependency tarballs to a third‑party mirror (mirrors.tencentyun.com). Before running npm install from this repo, either (1) inspect package-lock.json and the dependency source(s), (2) prefer installing dependencies from the official npm registry, or (3) vendor the minimal dependency (turndown) into a vetted location. If you only need the logic and don't want to run npm install, you can review browser.js and re-implement or run it in a sandbox where installing from external registries is acceptable. If you plan to run the provided npm install in production or on a host with sensitive credentials, audit the lockfile and downloaded tarballs first.

Type: OpenClaw Skill Name: markdown-browser Version: 1.0.0 The skill bundle is classified as suspicious due to a supply chain vulnerability identified in `package-lock.json`. Dependencies `turndown` and `@mixmark-io/domino` are resolved from `http://mirrors.tencentyun.com/npm/` instead of the official npm registry. While the provided code in `browser.js` appears benign and implements stated privacy and content normalization features (e.g., URL redaction), relying on a non-standard, potentially untrusted mirror introduces a significant risk of malicious package injection if the mirror is compromised or controlled by an attacker. There is no evidence of direct malicious intent in the skill's own code or prompt injection attempts in `SKILL.md` or `README.md`.