markdown-novel-viewer

Pass

Audited by Gen Agent Trust Hub on Apr 16, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes child_process.execSync to open the system's default web browser and child_process.spawn to manage server instances in the background. The file paths passed to these commands are sanitized via encodeURIComponent to prevent shell command injection.
  • [EXTERNAL_DOWNLOADS]: The project depends on standard and well-known npm packages (marked, highlight.js, gray-matter) for markdown processing. Additionally, the viewer template fetches CSS stylesheets for syntax highlighting from Cloudflare's public CDN, which is a common and trusted service.
  • [SAFE]: The server implements a security utility (isPathSafe) that validates all file access requests against a list of allowed directories, effectively preventing directory traversal attacks. Access is restricted to the application's assets, the current working directory, and the specific directory being viewed.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 16, 2026, 02:04 PM
Security Audit — agent-trust-hub — markdown-novel-viewer