Markdown Viewer

Live markdown viewer for AI pair-editing. When you collaborate, the updates render instantly. Works with any AI agent and web browser.

This appears to be what it says: a local markdown viewer implemented as an npm package. Before installing: (1) review the npm package/source (GitHub link in SKILL.md) to verify there are no unexpected behaviors or dependencies; (2) run it without elevated privileges and consider using --root to restrict filesystem access in shared environments; (3) avoid using it to open arbitrary system-sensitive paths (secrets, config files); and (4) remember installing from npm fetches code from the network — if you need stronger assurance, audit the package code or run it in a sandboxed environment.

Type: OpenClaw Skill Name: markdown-viewer Version: 1.2.0 The skill bundle is classified as suspicious due to a Local File Inclusion (LFI) vulnerability in the `mdview` tool, explicitly acknowledged in the `SKILL.md` file. The `/view?path=` parameter allows reading arbitrary files from the local filesystem, which could be exploited by an AI agent or user to disclose sensitive data. While the skill author transparently discloses this vulnerability and suggests a mitigation (`--root`), the presence of such a high-risk capability without clear instructions to prevent its misuse by the agent makes it suspicious. There is no evidence of intentional malicious behavior like data exfiltration or persistence.