url-to-markdown
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted content from external URLs, which creates an attack surface for indirect prompt injection if an agent subsequently reads the generated Markdown files.
- Ingestion points: HTML content fetched from user-provided URLs in
scripts/converter.jsvia thefetchAPI. - Boundary markers: Output is delimited with Markdown headers (
# Title) and a source footer (**Source:**) inscripts/cli.jsto separate extracted content from metadata. - Capability inventory: Performs network fetches in
scripts/converter.jsand writes files to the local filesystem inscripts/cli.jsusingfs.writeFileSync. - Sanitization: Employs
@mozilla/readabilityto isolate main article content andturndownto convert HTML to Markdown, which effectively strips most executable scripts and styles from the final output. - [SAFE]: The skill implementation follows secure coding practices, such as using timeouts for network requests, providing a dependency checker that does not automatically execute commands, and using explicit file system paths.
Audit Metadata