MD to Mobile Image

Convert Markdown files into high-contrast, mobile-friendly PNG images optimized for Telegram and social media sharing.

This tool appears to do what it says, but take these precautions before installing or running it: - Verify and fix the dependency mismatch: Playwright is required at runtime but not listed in package.json. Ask the author to add playwright (and ideally a clear install section) or install Playwright yourself and its browsers before running. - Prefer installing packages from an official registry. The package-lock references registry.npmmirror.com; confirm you trust that mirror or regenerate a lockfile using the official npm registry. - Treat input markdown as potentially untrusted: marked allows raw HTML, and the code loads the produced HTML into a real browser which will fetch and execute external resources. If you will convert untrusted markdown, run the tool in a network-isolated sandbox or modify the code to sanitize HTML (disable raw HTML in marked or run a sanitizer) and/or disable network access in Playwright. - Because Playwright launches Chromium, run the tool on a machine where installing large browser binaries is acceptable and sandboxed. If you want to proceed, ask the author for an updated package.json including playwright, clear install steps, and a note about network behavior; otherwise run the script in an isolated environment or container to limit exposure.

Type: OpenClaw Skill Name: md-to-image Version: 2.0.0 The skill bundle provides a utility to convert Markdown files into images using Playwright and marked.js. However, the implementation in `md-to-image.js` lacks input sanitization when converting Markdown to HTML and rendering it via `page.setContent()`. This vulnerability could allow for local file disclosure (LFI) or SSRF if the agent is tasked with processing a maliciously crafted Markdown file. Per the evaluation criteria, the lack of input sanitization in a high-risk execution context (headless browser) warrants a suspicious classification.