sawana-multicul/official-docs-to-mdx

Download and normalize official documentation pages into local .mdx files at user-specified paths using markdown.new. Use when user asks to fetch docs from a...

This skill is coherent with its stated goal, but before installing: 1) Understand it fetches content via https://markdown.new/<your-supplied-URL> — you are trusting that external service to retrieve and render the page. 2) The script will overwrite the output path you provide and will create parent directories; do not point it at system or important files. 3) If you plan to run it autonomously, review generated MDX for sensitive content before distributing. 4) The presence of an invisible unicode character in a regex is probably benign (it matches Docusaurus anchor markers) but you can inspect the script locally to confirm it does only the described cleaning steps.

Type: OpenClaw Skill Name: sawana-multicul-official-docs-to-mdx Version: 1.0.0 The skill is classified as suspicious due to a critical path traversal vulnerability in `scripts/mdnew_to_mdx.sh`. The script uses the user-provided output file path (`$out_file`) directly in `mkdir -p` and file redirection (`> "$out_file"`) without sanitization. This allows an attacker to write files to arbitrary locations on the filesystem using `../` sequences, enabling unauthorized file creation or modification outside the intended directory. There is no clear evidence of intentional malicious behavior, but this vulnerability poses a significant risk.