Skills baoyu-url-to-markdown

📦

baoyu-url-to-markdown

Name: baoyu-url-to-markdown
Author: jimliu

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Convert Web Pages to Markdown

Saving rendered web pages as readable notes is hard when pages rely on JavaScript or require manual login. This skill opens the page in Chrome, captures the rendered content, and writes a clean markdown file with metadata.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "baoyu-url-to-markdown" from https://skillstore.io/skills/jimliu-baoyu-url-to-markdown.md and its manifest at https://skillstore.io/api/skills/jimliu-baoyu-url-to-markdown/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/jimliu-baoyu-url-to-markdown.md Signed manifest GET /api/skills/jimliu-baoyu-url-to-markdown/manifest Signed lockfile GET /api/skills/jimliu-baoyu-url-to-markdown/lockfile

Test it

Using "baoyu-url-to-markdown". Capture a public article URL.

Expected outcome:

The skill saves a markdown document with source metadata, a title, headings, links, images, lists, and readable body text.

Using "baoyu-url-to-markdown". Capture a dashboard page after manual login using wait mode.

Expected outcome:

The skill waits for user confirmation, captures the current rendered page, and writes the visible content to a local markdown file.

Using "baoyu-url-to-markdown". Convert a page with tables and code snippets.

Expected outcome:

The output includes markdown tables, fenced code blocks, normalized links, and cleaned text where conversion is possible.

Security Audit

High Risk

v6 • 7/9/2026 Open versioned report

Most static findings are scanner noise from JavaScript template literals, markdown code blocks, localhost CDP communication, and standard path discovery. Real risks remain because the skill launches Chrome through child_process, uses local CDP network control, reads environment-controlled paths, and asks agents to read unreviewed EXTEND.md files that could alter behavior.

Files scanned

857

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:24-52 SKILL.md:118-120

Untrusted EXTEND.md Instructions Can Influence Agent Behavior

SKILL.md tells the agent to read project-level and user-level EXTEND.md files and apply their settings. Because those markdown files are outside the reviewed skill package, they could contain prompt injection or unsafe instructions that change how the agent runs the browser capture workflow.

The instructions explicitly direct the agent to read and apply external markdown configuration. I did not see guardrails limiting EXTEND.md to data-only settings or preventing prompt injection.

Medium

SKILL.md:56-59 SKILL.md:83-93 scripts/main.ts:161-167

Authenticated Page Capture May Save Sensitive Content

The skill supports wait mode for login-required pages and then writes captured page content to markdown. This is a user-facing feature, but it can persist private page contents, account data, or paid content locally without additional warnings.

The documentation states that wait mode is for login-required pages, and the implementation writes the captured document to disk. The risk is data persistence, not hidden exfiltration.

Capability review items (18)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/cdp.ts:1

Node.js child_process module

import { spawn, type ChildProcess } from "node:child_process";

The module imports child_process because the skill launches a local Chrome or Edge process. This is intended browser automation, but it is real external command execution and depends on local executable discovery.

High

scripts/cdp.ts:195

Process spawn

return spawn(chrome, args, { stdio: "ignore" });

The code spawns the resolved Chrome executable with command-line flags and a user-supplied URL. This is legitimate for the skill, but it is still external process execution with arguments influenced by input and environment.

High

scripts/cdp.ts:109

Net server creation (opens port)

const srv = net.createServer();

The server is used only to allocate a free localhost port and closes immediately. It is low risk, but it does bind a local socket during execution.

Medium

scripts/cdp.ts:66

WebSocket connection

const ws = new WebSocket(url);

The WebSocket connects to Chrome DevTools Protocol for browser automation. This is intended, but it gives the skill the ability to inspect and control the opened browser page.

Medium

scripts/cdp.ts:125

Environment variable access (dot notation)

const override = process.env.URL_CHROME_PATH?.trim();

The skill reads URL_CHROME_PATH from the environment and may execute that path as the browser binary. This is useful configuration but should be treated as sensitive execution control.

Medium

scripts/cdp.ts:125

Environment variable object

const override = process.env.URL_CHROME_PATH?.trim();

The environment object is used to read URL_CHROME_PATH, which controls the executable launched by the skill. That makes the access security relevant even though it is documented.

Medium

scripts/paths.ts:26

Environment variable access (dot notation)

const override = process.env.URL_CHROME_PROFILE_DIR?.trim();

URL_CHROME_PROFILE_DIR controls the persistent Chrome profile location used by the launched browser. This is documented but may expose cookies or session state if pointed at an existing profile.

Medium

scripts/paths.ts:26

Environment variable object

const override = process.env.URL_CHROME_PROFILE_DIR?.trim();

process.env is used to read URL_CHROME_PROFILE_DIR, which controls browser profile storage. That can affect local session data handling.

Medium

SKILL.md:63-72

Ruby/shell backtick execution

```bash

This section instructs the agent to run npx -y bun on the skill script. That is a real package-managed command execution path, even if it is expected for the skill.

Medium

SKILL.md:72-78

Ruby/shell backtick execution

```

The code block ending here contains npx -y bun execution examples. The commands are documented usage, but they still require shell execution by an agent.

Medium

SKILL.md:33

Hidden file access

test -f "$HOME/.baoyu-skills/baoyu-url-to-markdown/EXTEND.md" && echo "user"

The instructions tell the agent to check a hidden file under the user home directory. Accessing hidden user configuration is intentional, but it increases prompt and file trust risk.

Medium

SKILL.md:41

Hidden file access

│ $HOME/.baoyu-skills/baoyu-url-to-markdown/EXTEND.md │ User home │

The documented preference path points to a hidden file in the user home directory. This is an explicit hidden-file access pattern that can influence the skill behavior.

Low

scripts/cdp.ts:18

Fetch API call

if (!timeoutMs || timeoutMs <= 0) return fetch(url, rest);

fetch is used to poll the local Chrome debugging endpoint and is part of the CDP connection flow. It is not exfiltration, but it is real network access performed by the skill.

Low

scripts/cdp.ts:22

Fetch API call

return await fetch(url, { ...rest, signal: ctl.signal });

fetch is used with an AbortController to communicate with the local Chrome debugging endpoint. This is expected behavior, but it confirms network capability.

Low

scripts/cdp.ts:126

Node.js fs stat operations

if (override && fs.existsSync(override)) return override;

The code checks whether URL_CHROME_PATH points to an existing executable. This is a legitimate existence check, but it trusts an environment-controlled path for later execution.

Low

scripts/cdp.ts:160

Node.js fs stat operations

if (fs.existsSync(p)) return p;

The code probes hardcoded browser executable paths with existsSync. This is expected platform discovery and has limited security impact.

Low

scripts/paths.ts:20

Environment variable access (dot notation)

const override = process.env.URL_DATA_DIR?.trim();

URL_DATA_DIR changes where captured markdown is written. This is documented configuration, but environment-controlled output paths can redirect filesystem writes.

Low

scripts/paths.ts:20

Environment variable object

const override = process.env.URL_DATA_DIR?.trim();

process.env is used to read URL_DATA_DIR, which controls the output directory. This is low risk but security relevant because it affects filesystem writes.

Risk Factors

⚙️ External commands (50)

🌐 Network access (8)

scripts/cdp.ts:18 scripts/cdp.ts:22 scripts/cdp.ts:66 scripts/cdp.ts:109 scripts/cdp.ts:169 scripts/cdp.ts:112 scripts/cdp.ts:169 scripts/constants.ts:4

📁 Filesystem access (4)

scripts/cdp.ts:126 scripts/cdp.ts:160 SKILL.md:33 SKILL.md:41

🔑 Env variables (10)

scripts/cdp.ts:125 scripts/cdp.ts:125 scripts/paths.ts:11 scripts/paths.ts:16 scripts/paths.ts:20 scripts/paths.ts:26 scripts/paths.ts:11 scripts/paths.ts:16 scripts/paths.ts:20 scripts/paths.ts:26

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/jimliu-baoyu-url-to-markdown/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/jimliu-baoyu-url-to-markdown/security.svg)](https://skillstore.io/skills/jimliu-baoyu-url-to-markdown?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/jimliu-baoyu-url-to-markdown?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/jimliu-baoyu-url-to-markdown/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/jimliu-baoyu-url-to-markdown.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

jimliu. (2026). baoyu-url-to-markdown security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/jimliu-baoyu-url-to-markdown/audits/6

BibTeX citation

@techreport{jimliu-jimliu-baoyu-url-to-markdown-2026,
  author = {jimliu},
  title = {baoyu-url-to-markdown security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/jimliu-baoyu-url-to-markdown/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "baoyu-url-to-markdown security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "jimliu"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/jimliu-baoyu-url-to-markdown/audits/6"
identifiers:
  - type: other
    value: "skillstore:jimliu-baoyu-url-to-markdown:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Archive Research Sources

Save rendered articles as markdown with source metadata for later review.

Capture Dynamic Documentation

Convert JavaScript-rendered documentation pages into local markdown notes.

Save Pages After Manual Login

Use wait mode to capture a page after the user completes login or page preparation.

Try These Prompts

Capture a public page

Use baoyu-url-to-markdown to save this public web page as markdown: <url>. Use the default output location.

Save to a specific file

Convert <url> to markdown with baoyu-url-to-markdown and save it to <output-path>. Tell me the saved file path when finished.

Capture after page preparation

Open <url> with baoyu-url-to-markdown in wait mode. Pause until I confirm the page is ready, then capture it as markdown.

Build a source archive

Convert these URLs to markdown with baoyu-url-to-markdown, keep each file in the default domain folder, and summarize any capture failures: <url-list>.

Best Practices

Review the page before using wait mode on private or authenticated content.
Use a dedicated Chrome profile when capturing sensitive pages.
Check the saved markdown for missing lazy-loaded sections or layout-specific content.

Avoid

Do not capture confidential pages unless you intend to store their content locally.
Do not point URL_CHROME_PATH at an untrusted executable.
Do not treat EXTEND.md files as trusted instructions from the marketplace skill.