Md Viewer

LAN-accessible web viewer for Markdown files optimized for e-readers. Auto-binds to LAN IP for easy access. TRIGGER when user says "cho tôi xem", "show me",...

This skill appears to be what it claims: a local LAN web viewer for .md files. Before installing, consider these practical security/privacy points: - Network exposure: the default behavior auto-binds to your LAN IP and opens a listening port (8765). Only run on trusted networks or use the --localhost option to restrict to loopback. - URL tokens: links include the password/token in the URL. Tokens in URLs can leak via browser referrers, logs, or chat messages. Treat links as sensitive and avoid sharing on untrusted systems. - Cookie lifetime & auth: the cookie is persistent (30 days). If someone can access the browser on a device that opened the link, they may gain access until the cookie expires. - History file: the server stores a history file (~/.md-viewer-history.json) that may include names/paths of viewed files. Use --no-history if you prefer not to persist that. - Path checks: the code blocks common sensitive paths/patterns, but path-blocking is based on string checks. If you have concerns, review server.py to confirm it resolves symlinks and enforces absolute paths before serving. - Sanitization: the code prefers bleach for sanitization; if bleach is not installed, it falls back to regex-based sanitization which is less robust. Install bleach (pip3 install bleach) to improve XSS protection. If you want to minimize risk: run with --localhost, use a strong custom password (--password), disable history (--no-history), and keep bleach installed. Review the bundled server.py yourself if you handle sensitive files.