web-to-markdown

Warn

Audited by Socket on Sep 18, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/fetch_generic_fallback.mjs

The shown code is consistent with a generic web-page scraper and contains no clear malware indicators. It does introduce a potentially significant SSRF risk because caller-controlled URLs are fetched both by HTTP and by a headless browser without visible destination validation. Browser JavaScript execution and disabled Chromium sandboxing further increase risk in hostile environments. The risk depends on whether untrusted users can supply URLs and on controls implemented elsewhere in the larger file or application.

Confidence: 93%Severity: 62%
Audit Metadata
Analyzed At
Sep 18, 2026, 03:22 PM
Package URL
pkg:socket/skills-sh/rookie-ricardo%2Ferduo-skills%2Fweb-to-markdown%2F@72300cc65b9317e9743e9e6af32890fceaa25205ddc27fbfb9b4f33ea68205a3