Markdown Canvas

Convert markdown files to beautiful HTML pages suitable for Canvas display or browser viewing. Use when user asks to render, visualize, display, or share mar...

This skill does what it says (convert .md → .html) and only needs python3, but it has a security bug: the converter inserts most markdown output into the template without escaping or sanitizing it. That means a malicious or untrusted .md file could inject HTML (including <script> tags) or use javascript: links that execute when the output is opened or shared. Before installing or using on untrusted content: (1) avoid opening or publishing generated HTML from untrusted sources; (2) prefer or request that the author add proper escaping/sanitization (use a well-maintained Markdown library + an HTML sanitizer such as Python's markdown + bleach, or ensure process_inline_formatting applies escape_html before inserting text and validate/sanitize URLs); (3) review or test the script locally with representative inputs; (4) consider using established tooling that enforces safe defaults. If you only convert trusted personal notes, the risk is lower, but heed caution when sharing or running on external markdown.

Type: OpenClaw Skill Name: markdown-canvas Version: 1.0.2 The `scripts/convert.py` file contains a critical Cross-Site Scripting (XSS) vulnerability. The `convert_markdown_to_html` function does not properly sanitize or escape user-provided markdown content before injecting it into the `{{CONTENT}}` placeholder in `assets/template.html`. This allows an attacker to inject arbitrary HTML and JavaScript into the generated HTML page by including raw HTML tags (e.g., `<script>alert('XSS')</script>`) in the input markdown file. This is a severe vulnerability, but there is no evidence of intentional malicious behavior like data exfiltration or persistence.