preview-markdown
No security findings. Scanned 1 time, most recently 2026-02-07.
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Render and preview Markdown files in browser with GitHub-flavored formatting and syntax highlighting
- Package
- 12 files, 74 KB
- SKILL.md
- 593 words, 12+ sections
- Code
- Shell (5), JavaScript (3)
SKILL.md covers: Preview Markdown Skill · Usage · Preview a Markdown file · Pipe Markdown content (preferred for temporary content) · With custom background color · Options · Features · When to Use This Skill · Examples · Technical Details · File Requirements · Features in Detail
Findings
No findings. SAFE
What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 4.2 KB |
config.sh | script | 1.2 KB |
run.sh | script | 6.6 KB |
lib/browser-utils.sh | script | 9.9 KB |
lib/content-utils.sh | script | 6.7 KB |
lib/html-generator.sh | script | 13 KB |
templates/scripts/common-ui.js | script | 5.1 KB |
templates/scripts/markdown-renderer.js | script | 5.2 KB |
templates/scripts/utils.js | script | 1.8 KB |
templates/styles/common.css | data | 1.6 KB |
templates/styles/layout.css | data | 13 KB |
templates/styles/markdown.css | data | 5.8 KB |
External hosts referenced
cdn.jsdelivr.net unpkg.com cdnjs.cloudflare.com fonts.googleapis.com github.com fonts.gstatic.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
TEMP_DIR GITHUB_REPO ALLOWED_CDN_DOMAINS OUTPUT_PATH
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/preview-markdown
- Raw scan result: preview-markdown-scan.json
- Badge for your README:
- Request a re-scan