技能 baoyu-url-to-markdown

📦

baoyu-url-to-markdown

Name: baoyu-url-to-markdown
Author: jimliu

内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量

将网页转换为 Markdown

当页面依赖 JavaScript 或需要手动登录时，将渲染后的网页保存为可读笔记并不容易。此技能会在 Chrome 中打开页面，捕获渲染后的内容，并写入带有元数据的整洁 Markdown 文件。

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "baoyu-url-to-markdown" from https://skillstore.io/skills/jimliu-baoyu-url-to-markdown.md and its manifest at https://skillstore.io/api/skills/jimliu-baoyu-url-to-markdown/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/jimliu-baoyu-url-to-markdown.md 已签名 manifest GET /api/skills/jimliu-baoyu-url-to-markdown/manifest 已签名 lockfile GET /api/skills/jimliu-baoyu-url-to-markdown/lockfile

测试它

正在使用“baoyu-url-to-markdown”。捕获公开文章 URL。

预期结果:

该技能会保存一个包含来源元数据、标题、标题层级、链接、图片、列表和可读正文文本的 Markdown 文档。

正在使用“baoyu-url-to-markdown”。使用等待模式在手动登录后捕获仪表板页面。

预期结果:

该技能会等待用户确认，捕获当前渲染后的页面，并将可见内容写入本地 Markdown 文件。

正在使用“baoyu-url-to-markdown”。转换包含表格和代码片段的页面。

预期结果:

在可转换的情况下，输出会包含 Markdown 表格、围栏代码块、规范化链接和清理后的文本。

安全审计

高风险

v6 • 2026/7/9 打开版本化报告

Most static findings are scanner noise from JavaScript template literals, markdown code blocks, localhost CDP communication, and standard path discovery. Real risks remain because the skill launches Chrome through child_process, uses local CDP network control, reads environment-controlled paths, and asks agents to read unreviewed EXTEND.md files that could alter behavior.

已扫描文件

857

分析行数

复核项

已忽略误报

已确认安全问题 (2)

高

SKILL.md:24-52 SKILL.md:118-120

Untrusted EXTEND.md Instructions Can Influence Agent Behavior

SKILL.md tells the agent to read project-level and user-level EXTEND.md files and apply their settings. Because those markdown files are outside the reviewed skill package, they could contain prompt injection or unsafe instructions that change how the agent runs the browser capture workflow.

The instructions explicitly direct the agent to read and apply external markdown configuration. I did not see guardrails limiting EXTEND.md to data-only settings or preventing prompt injection.

中

SKILL.md:56-59 SKILL.md:83-93 scripts/main.ts:161-167

Authenticated Page Capture May Save Sensitive Content

The skill supports wait mode for login-required pages and then writes captured page content to markdown. This is a user-facing feature, but it can persist private page contents, account data, or paid content locally without additional warnings.

The documentation states that wait mode is for login-required pages, and the implementation writes the captured document to disk. The risk is data persistence, not hidden exfiltration.

能力复核项 (18)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高

scripts/cdp.ts:1

Node.js child_process module

import { spawn, type ChildProcess } from "node:child_process";

The module imports child_process because the skill launches a local Chrome or Edge process. This is intended browser automation, but it is real external command execution and depends on local executable discovery.

高

scripts/cdp.ts:195

Process spawn

return spawn(chrome, args, { stdio: "ignore" });

The code spawns the resolved Chrome executable with command-line flags and a user-supplied URL. This is legitimate for the skill, but it is still external process execution with arguments influenced by input and environment.

高

scripts/cdp.ts:109

Net server creation (opens port)

const srv = net.createServer();

The server is used only to allocate a free localhost port and closes immediately. It is low risk, but it does bind a local socket during execution.

中

scripts/cdp.ts:66

WebSocket connection

const ws = new WebSocket(url);

The WebSocket connects to Chrome DevTools Protocol for browser automation. This is intended, but it gives the skill the ability to inspect and control the opened browser page.

中

scripts/cdp.ts:125

Environment variable access (dot notation)

const override = process.env.URL_CHROME_PATH?.trim();

The skill reads URL_CHROME_PATH from the environment and may execute that path as the browser binary. This is useful configuration but should be treated as sensitive execution control.

中

scripts/cdp.ts:125

Environment variable object

const override = process.env.URL_CHROME_PATH?.trim();

The environment object is used to read URL_CHROME_PATH, which controls the executable launched by the skill. That makes the access security relevant even though it is documented.

中

scripts/paths.ts:26

Environment variable access (dot notation)

const override = process.env.URL_CHROME_PROFILE_DIR?.trim();

URL_CHROME_PROFILE_DIR controls the persistent Chrome profile location used by the launched browser. This is documented but may expose cookies or session state if pointed at an existing profile.

中

scripts/paths.ts:26

Environment variable object

const override = process.env.URL_CHROME_PROFILE_DIR?.trim();

process.env is used to read URL_CHROME_PROFILE_DIR, which controls browser profile storage. That can affect local session data handling.

中

SKILL.md:63-72

Ruby/shell backtick execution

```bash

This section instructs the agent to run npx -y bun on the skill script. That is a real package-managed command execution path, even if it is expected for the skill.

中

SKILL.md:72-78

Ruby/shell backtick execution

```

The code block ending here contains npx -y bun execution examples. The commands are documented usage, but they still require shell execution by an agent.

中

SKILL.md:33

Hidden file access

test -f "$HOME/.baoyu-skills/baoyu-url-to-markdown/EXTEND.md" && echo "user"

The instructions tell the agent to check a hidden file under the user home directory. Accessing hidden user configuration is intentional, but it increases prompt and file trust risk.

中

SKILL.md:41

Hidden file access

│ $HOME/.baoyu-skills/baoyu-url-to-markdown/EXTEND.md │ User home │

The documented preference path points to a hidden file in the user home directory. This is an explicit hidden-file access pattern that can influence the skill behavior.

低

scripts/cdp.ts:18

Fetch API call

if (!timeoutMs || timeoutMs <= 0) return fetch(url, rest);

fetch is used to poll the local Chrome debugging endpoint and is part of the CDP connection flow. It is not exfiltration, but it is real network access performed by the skill.

低

scripts/cdp.ts:22

Fetch API call

return await fetch(url, { ...rest, signal: ctl.signal });

fetch is used with an AbortController to communicate with the local Chrome debugging endpoint. This is expected behavior, but it confirms network capability.

低

scripts/cdp.ts:126

Node.js fs stat operations

if (override && fs.existsSync(override)) return override;

The code checks whether URL_CHROME_PATH points to an existing executable. This is a legitimate existence check, but it trusts an environment-controlled path for later execution.

低

scripts/cdp.ts:160

Node.js fs stat operations

if (fs.existsSync(p)) return p;

The code probes hardcoded browser executable paths with existsSync. This is expected platform discovery and has limited security impact.

低

scripts/paths.ts:20

Environment variable access (dot notation)

const override = process.env.URL_DATA_DIR?.trim();

URL_DATA_DIR changes where captured markdown is written. This is documented configuration, but environment-controlled output paths can redirect filesystem writes.

低

scripts/paths.ts:20

Environment variable object

const override = process.env.URL_DATA_DIR?.trim();

process.env is used to read URL_DATA_DIR, which controls the output directory. This is low risk but security relevant because it affects filesystem writes.

风险因素

⚙️ 外部命令 (50)

🌐 网络访问 (8)

scripts/cdp.ts:18 scripts/cdp.ts:22 scripts/cdp.ts:66 scripts/cdp.ts:109 scripts/cdp.ts:169 scripts/cdp.ts:112 scripts/cdp.ts:169 scripts/constants.ts:4

📁 文件系统访问 (4)

scripts/cdp.ts:126 scripts/cdp.ts:160 SKILL.md:33 SKILL.md:41

🔑 环境变量 (10)

scripts/cdp.ts:125 scripts/cdp.ts:125 scripts/paths.ts:11 scripts/paths.ts:16 scripts/paths.ts:20 scripts/paths.ts:26 scripts/paths.ts:11 scripts/paths.ts:16 scripts/paths.ts:20 scripts/paths.ts:26

审计者: claude 查看审计历史 →

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/jimliu-baoyu-url-to-markdown/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/jimliu-baoyu-url-to-markdown/security.svg)](https://skillstore.io/skills/jimliu-baoyu-url-to-markdown?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/jimliu-baoyu-url-to-markdown?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/jimliu-baoyu-url-to-markdown/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/jimliu-baoyu-url-to-markdown.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

jimliu. (2026). baoyu-url-to-markdown security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/jimliu-baoyu-url-to-markdown/audits/6

BibTeX 引用

@techreport{jimliu-jimliu-baoyu-url-to-markdown-2026,
  author = {jimliu},
  title = {baoyu-url-to-markdown security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/jimliu-baoyu-url-to-markdown/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "baoyu-url-to-markdown security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "jimliu"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/jimliu-baoyu-url-to-markdown/audits/6"
identifiers:
  - type: other
    value: "skillstore:jimliu-baoyu-url-to-markdown:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 高

架构

可维护性

内容

社区

规范符合性

你能构建什么

归档研究来源

将渲染后的文章保存为带有来源元数据的 Markdown，便于之后审阅。

捕获动态文档

将 JavaScript 渲染的文档页面转换为本地 Markdown 笔记。

手动登录后保存页面

在用户完成登录或页面准备后，使用等待模式捕获页面。

试试这些提示

捕获公开页面

Use baoyu-url-to-markdown to save this public web page as markdown: <url>. Use the default output location.

保存到指定文件

Convert <url> to markdown with baoyu-url-to-markdown and save it to <output-path>. Tell me the saved file path when finished.

页面准备后捕获

Open <url> with baoyu-url-to-markdown in wait mode. Pause until I confirm the page is ready, then capture it as markdown.

构建来源归档

Convert these URLs to markdown with baoyu-url-to-markdown, keep each file in the default domain folder, and summarize any capture failures: <url-list>.