Mdnew

Fetch clean, token-efficient Markdown from any URL using markdown.new, optimized for deep analysis with JS support and stripped of boilerplate content.

This skill will instruct an external service (markdown.new) to fetch whatever URL you pass it. That can leak sensitive data in two ways: (1) URLs often contain tokens or query parameters that reveal secrets, and (2) you may unintentionally ask the external service to fetch internal-only endpoints. Before installing or using: (a) verify who runs markdown.new and whether you trust that operator, (b) never pass URLs containing secrets or authentication tokens, (c) avoid pointing the tool at internal/private network addresses, (d) consider adding URL validation/whitelisting or percent-encoding before sending, and (e) if you need to process sensitive pages, run a local/managed converter instead of an unknown third-party. If you want me to, I can suggest safer local alternatives or propose a small patched script that validates/encodes URLs and warns about internal addresses.

Type: OpenClaw Skill Name: mdnew Version: 1.0.0 The skill is designed to fetch markdown content from a user-provided URL via the `markdown.new` service. The `SKILL.md` instructions are clear and do not contain any prompt injection attempts. The `scripts/mdnew.py` code makes a straightforward HTTP request to `https://markdown.new/` with the target URL embedded in the path. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation. While the skill makes an outbound network request to an external service with a user-controlled URL, this is its stated purpose and does not indicate malicious intent or introduce high-risk vulnerabilities within the skill's own code.