guizang-page-skill

This is a local Markdown-to-HTML renderer, not apparent malware; it reads local input files and writes a generated document to the requested output path. Its main security issue is unsanitized HTML and insufficient escaping or URL-scheme validation in multiple rendering paths, which can enable script injection in the generated HTML when content is untrusted. No suspicious domains, IPs, credential targets, or data-exfiltration behavior are present; severity is a security warning for untrusted content.

This is an HTML-to-PDF/PNG exporter, not evidence of standalone malware. Its main security concern is rendering untrusted local HTML or URLs in Chromium with --no-sandbox and --allow-file-access-from-files, which can enable malicious page scripts to access local resources or make outbound requests. Use only with trusted input or an appropriately isolated environment; severity is moderate and depends on input trust.