← Back to Skills Marketplace
Skill 2
by
claudiodrusus
· GitHub ↗
· v1.0.0
598
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install skill-2
Description
Convert Markdown text to beautifully styled, self-contained HTML with embedded CSS. Perfect for newsletters, documentation, reports, and email templates.
Usage Guidance
This skill appears to do what it says and runs locally, but treat output HTML as potentially unsafe if the Markdown is untrusted. Before using with third-party or user-provided Markdown, either: (a) sanitize the input (or sanitize the produced HTML) to strip scripts, javascript: URIs, and dangerous tags/attributes (e.g., using html.escape or a library like bleach), (b) avoid opening generated HTML in a browser for untrusted content, or (c) extend the tool to escape HTML in non-code text and validate/relativize image/link URLs. Also note that images referenced in the Markdown will be loaded by a browser when the HTML is opened, which can leak requester IPs and other metadata. If you need robust CommonMark compliance and XSS protection, prefer a well-maintained Markdown library plus an HTML sanitizer.
Capability Analysis
Type: OpenClaw Skill
Name: skill-2
Version: 1.0.0
The `main.py` script contains a Cross-Site Scripting (XSS) vulnerability. User-provided URLs in Markdown links and images (e.g., `[text](url)` or ``) are directly inserted into the output HTML's `href` and `src` attributes without proper sanitization. This allows an attacker to inject `javascript:` URLs, leading to arbitrary JavaScript execution when the generated HTML is viewed, making the skill's output potentially malicious.
Capability Assessment
Purpose & Capability
Name/description match the provided files: a small, zero-dependency Python tool that converts Markdown to styled HTML with embedded CSS. The code implements the claimed features (headings, lists, links, images, code blocks, etc.), though 'Full Markdown support' is an optimistic claim (the converter is a hand-rolled subset, not a complete CommonMark implementation).
Instruction Scope
SKILL.md and main.py are scoped to reading a file or stdin and producing an HTML file (expected). However, the converter does not HTML-escape arbitrary non-code text nor sanitize links/images. That means user-supplied Markdown can inject raw HTML or create links with javascript: URIs, and produced HTML can cause remote resource loads (images) or XSS when opened in a browser. The README does not warn about these risks and 'self-contained' might be misread as 'no external resource loads' (only the CSS is embedded).
Install Mechanism
No install spec; instruction-only with a single local Python script that uses the standard library. Nothing is downloaded or written beyond outputs the script itself creates (the HTML output file). Low install risk.
Credentials
No environment variables, credentials, or config paths are requested — proportional and appropriate for a local file conversion utility.
Persistence & Privilege
No persistent or elevated privileges requested. always is false; the skill does not modify other skills or system configuration.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skill-2 - After installation, invoke the skill by name or use
/skill-2 - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of "markdown-to-html" tool.
- Convert Markdown files to self-contained, styled HTML with embedded CSS.
- Supports full Markdown syntax: headings, formatting, links, images, code, lists, tables, and more.
- Includes two built-in themes: light (GitHub-inspired) and dark mode.
- Produces responsive designs suitable for desktop and mobile.
- Works with files or piped input (stdin); no external Python dependencies.
- Flexible command-line options for theme, title, and output file.
Metadata
Frequently Asked Questions
What is Skill 2?
Convert Markdown text to beautifully styled, self-contained HTML with embedded CSS. Perfect for newsletters, documentation, reports, and email templates. It is an AI Agent Skill for Claude Code / OpenClaw, with 598 downloads so far.
How do I install Skill 2?
Run "/install skill-2" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Skill 2 free?
Yes, Skill 2 is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Skill 2 support?
Skill 2 is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Skill 2?
It is built and maintained by claudiodrusus (@claudiodrusus); the current version is v1.0.0.
More Skills