Markdown to HTML Converter

Convert Markdown files to formatted HTML. Use when the user asks to convert, export, or save a Markdown file as HTML format. Triggers on phrases like "conver...

This skill appears to do what it says and does not request credentials or external installs, but its HTML escaping is incomplete. If you will convert untrusted Markdown (e.g., user-submitted content) and publish HTML to a website or CMS, you should: (1) review and fix/augment the converter to properly escape or sanitize inline code, link text, image alt text and other content; (2) or run the produced HTML through a well-maintained HTML sanitizer (e.g., DOMPurify or your CMS's sanitizer) before publishing; (3) consider using a battle-tested Markdown library (marked, markdown-it) if you need robust parsing/security; and (4) test with malicious examples (e.g., <script> tags in inline code or malformed link/image syntax) to verify sanitization. The SKILL.md claim about "safe escaping" is incomplete—treat output as potentially unsafe until sanitized.

Type: OpenClaw Skill Name: md-2-html Version: 1.0.1 The skill provides a Markdown-to-HTML conversion utility via `scripts/md2html.js`. While the code is functional and lacks evidence of intentional malice, it contains a security vulnerability: the regex-based parser does not sanitize URLs in links or images, which could allow Cross-Site Scripting (XSS) if the output is rendered in a browser. Per the provided instructions, unintentional vulnerabilities are classified as suspicious.