markdown-extract

Extract clean markdown from any URL using auto, AI, or browser methods via the markdown.new API with error handling and flexible extraction options.

Before installing, note these points: (1) The Python script uses the system 'curl' command but the skill metadata does not declare it—ensure curl is available or update the manifest. (2) All requests (the requested URL and any fetched content) are sent to markdown.new; verify you trust that endpoint and avoid using the skill on sensitive or internal URLs. (3) Because the skill fetches arbitrary URLs, there is an SSRF/data-exposure risk if the agent runs in an environment with access to internal services. (4) The code uses subprocess.run with argument lists (not a shell string), which reduces shell-injection risk, but still review the script before granting execution. If you want to proceed, test with non-sensitive public pages and consider adding an explicit required-binaries entry for 'curl' and a manifest note about external data transmission.

Type: OpenClaw Skill Name: markdown-extract Version: 1.0.0 The skill's code and documentation are benign. The `SKILL.md` file provides clear, non-malicious instructions for using the skill. The `extract.py` script correctly uses `subprocess.run` with a list of arguments for `curl`, which prevents shell injection vulnerabilities from user-controlled input. The skill's functionality is limited to making HTTP requests to the `https://markdown.new/` API, as described, and does not attempt to access sensitive local data, exfiltrate information, or establish persistence. While the skill relies on an external API, its own implementation does not introduce vulnerabilities or malicious behavior.