Markdown to HTML

Convert Markdown text to beautifully styled, self-contained HTML with embedded CSS. Perfect for newsletters, documentation, reports, and email templates.

This skill appears to be what it says: a small, local Python script that converts Markdown to styled HTML and writes an output file. Before using it in production or serving generated HTML to users, consider that the converter does not sanitize input: raw HTML present in Markdown, or crafted link/image URLs and alt text, will be included verbatim in output (the code escapes code-block contents but does not escape inline text/URLs). That can create XSS or unsafe email content if the Markdown is untrusted. If you plan to process untrusted Markdown, either sanitize the result (e.g., use an HTML sanitizer like bleach) or extend the tool to escape/validate URLs and inline text. Otherwise this skill is coherent and low-risk in terms of hidden network/credential behavior.

Type: OpenClaw Skill Name: markdown-to-html Version: 1.1.0 The skill is classified as suspicious due to a significant Cross-Site Scripting (XSS) vulnerability in the `main.py` script. The `md_to_html` function, specifically within the `inline` helper, fails to properly escape user-provided markdown content for link text and image alt text before embedding it into the generated HTML. This allows an attacker to inject arbitrary HTML/JavaScript into the output, which could lead to client-side attacks when the generated HTML is viewed. There are no other indicators of malicious intent such as data exfiltration, persistence, or direct prompt injection attempts against the OpenClaw agent in `SKILL.md`.