markdown-injection-scanner

Name: markdown-injection-scanner
Author: tranhieutt

69stars41forks

How to install markdown-injection-scanner?

tranhieutt/software_development_department/markdown-injection-scanner

$npx -y skills add tranhieutt/software_development_department --skill markdown-injection-scanner

Installs into the current project.

Summary

Scans Markdown (.md) files for malicious code injection including XSS, prompt injection, script injection, obfuscated payloads, and supply chain attack vectors. Use when auditing .md files for security threats or when the user mentions scanning markdown for malicious content.

Files · 1

View on GitHub

SKILL.md

1	# Markdown Injection Scanner
2
3	Scans all `.md` files in a target directory for 18 categories of malicious code injection.
4	Uses regex pattern matching across the entire file corpus with parallel subagent execution for speed.
5
6	## Usage
7
8	```
9	/markdown-injection-scanner [target-directory]
10	```
11
12	If no directory is specified, ask the user to provide one.
13
14	---
15
16	## Phase 1: Discovery — Map the File Corpus
17
18	1. Count all .md files in target directory (recursive).
19
20	2. Sample 2-3 files to understand the file structure and content type (design docs, documentation, config, etc.).
21
22	3. Report file count and content type before proceeding.
23
24	---
25
26	## Phase 2: Parallel Injection Scanning
27
28	Execute scans in 3 parallel batches using subagents for speed. Each subagent uses `search_files` with the target directory path and `*.md` file pattern.
29
30	### Batch 1 — Script and Code Injection (5 patterns)
31
32	\| # \| Category \| Regex Pattern \| Threat \|
33	\|---\|----------\|---------------\|--------\|
34	\| 1 \| Script tags \| `<script[^>]*>` \| Embedded JavaScript execution \|
35	\| 2 \| HTML Event Handlers \| `(onclick\\|onerror\\|onload\\|onmouseover\\|onfocus\\|onblur\\|onresize\\|onsubmit\\|onchange\\|oninput\\|onkeydown\\|onkeyup\\|onkeypress\\|ontouchstart\\|onmouseenter\\|onmouseleave)\s*=` \| Inline JS via HTML attributes \|
36	\| 3 \| JS/VBScript Protocol \| `(javascript:\\|vbscript:)` \| Malicious link protocols \|
37	\| 4 \| Dynamic Code Execution \| `(eval\s\(\\|Function\s\(\\|setTimeout\s\(\\|setInterval\s\()` \| Code execution via eval/setTimeout \|
38	\| 5 \| DOM Manipulation \| `(document\.(cookie\\|domain\\|write)\\|window\.(location\\|open)\\|XMLHttpRequest\\|fetch\s*\()` \| DOM-based attacks \|
39
40	### Batch 2 — Obfuscation and Encoding (6 patterns)
41
42	\| # \| Category \| Regex Pattern \| Threat \|
43	\|---\|----------\|---------------\|--------\|
44	\| 6 \| Base64 Payloads \| `(base64\\|atob\\|btoa\\|b64decode\\|b64encode)[\s(]` \| Encoded malicious content \|
45	\| 7 \| Data URI Injection \| `data:\s*(text/html\\|application/javascript\\|text/javascript)` \| Inline HTML/JS via data URIs \|
46	\| 8 \| SVG Injection \| `<svg[^>]*>` \| SVG-based XSS vectors \|
47	\| 9 \| Hex/Unicode Encoding \| `(\\x[0-9a-fA-F]{2}\\|\\u[0-9a-fA-F]{4}\\|&#x[0-9a-fA-F]+;)` \| Obfuscated character encoding \|
48	\| 10 \| Hidden Text — display:none \| `<(span\\|div\\|p)[^>]style\s=\s['"][^'"]display\s:\snone` \| Hidden content tricks \|
49	\| 11 \| Hidden Text — font-size:0 \| `font-size\s:\s0` \| Invisible text \|
50
51	### Batch 3 — Injection Vectors (7 patterns)
52
53	\| # \| Category \| Regex Pattern \| Threat \|
54	\|---\|----------\|---------------\|--------\|
55	\| 12 \| HTML Tag Injection \| `<(iframe\\|embed\\|object\\|link\\|meta\\|form\\|input\\|textarea\\|button)[\s>]` \| Injected HTML elements \|
56	\| 13 \| Suspicious Markdown Links \| `\[.?\]\(data:` then `\[.?\]\(javascript:` then `\[.*?\]\(vbscript:` \| Malicious link targets \|
57	\| 14 \| Prompt Injection (NL) \| `(?i)(ignore\s+(all\s+)?previous\s+instructions\\|you\s+are\s+now\\|forget\s+(all\s+)?previous\\|system\s:\syou\s+are\\|disregard\s+(all\s+)?prior\\|override\s+(all\s+)?instructions\\|new\s+instructions?:\\|IMPORTANT:.*ignore\\|do\s+not\s+follow)` \| AI/LLM prompt hijacking \|
58	\| 15 \| Prompt Injection (Token) \| `(?i)(\[INST\]\\|\[\/INST\]\\|<\\|im_start\\|>\\|<\\|im_end\\|>\\|<\\|system\\|>\\|<\\|user\\|>\\|<\\|assistant\\|>\\|Human:\\|Assistant:\\|###\sSystem\sPrompt\\|BEGIN\s+HIDDEN\\|END\s+HIDDEN)` \| LLM token format injection \|
59	\| 16 \| Shell Command Injection \| `(curl\s+\\|wget\s+\\|bash\s+-c\\|sh\s+-c\\|powershell\\|cmd\.exe\\|/bin/sh\\|/bin/bash\\|rm\s+-rf\\|chmod\s+777\\|sudo\s+)` \| Shell command execution \|
60	\| 17 \| Executable File Links \| `(https?://[^\s)>\]]*\.(exe\\|bat\\|cmd\\|ps1\\|sh\\|msi\\|dll\\|vbs\\|wsf\\|hta\\|scr))` \| Links to malicious executables \|
61	\| 18 \| Malware Keywords \| `(?i)(steganograph\\|obfusc\\|malware\\|payload\\|exploit\\|backdoor\\|trojan\\|keylog\\|ransom\\|phish)` \| Direct malware references \|
62
63	### Subagent Prompt Templates
64
65	Use 3 subagents via `use_subagents`, each with prompts corresponding to their batch patterns above. Replace `[TARGET_DIR]` with the actual target directory.
66
67	Subagent 1 — Script and Code Injection:
68	```
69	Search for script and code injection patterns in .md files in "[TARGET_DIR]". Use search_files with these regex patterns on *.md files, one at a time:
70	1. `<script[^>]*>`
71	2. `(onclick\|onerror\|onload\|onmouseover\|onfocus\|onblur\|onresize\|onsubmit\|onchange\|oninput\|onkeydown\|onkeyup\|onkeypress\|ontouchstart

People who liked this also viewed

6 picks

Type

markdown-injection-scanner

69stars41forks

View on GitHub

How to install markdown-injection-scanner?

tranhieutt/software_development_department/markdown-injection-scanner

$npx -y skills add tranhieutt/software_development_department --skill markdown-injection-scanner

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Markdown Injection Scanner
2
3	Scans all `.md` files in a target directory for 18 categories of malicious code injection.
4	Uses regex pattern matching across the entire file corpus with parallel subagent execution for speed.
5
6	## Usage
7
8	```
9	/markdown-injection-scanner [target-directory]
10	```
11
12	If no directory is specified, ask the user to provide one.
13
14	---
15
16	## Phase 1: Discovery — Map the File Corpus
17
18	1. Count all .md files in target directory (recursive).
19
20	2. Sample 2-3 files to understand the file structure and content type (design docs, documentation, config, etc.).
21
22	3. Report file count and content type before proceeding.
23
24	---
25
26	## Phase 2: Parallel Injection Scanning
27
28	Execute scans in 3 parallel batches using subagents for speed. Each subagent uses `search_files` with the target directory path and `*.md` file pattern.
29
30	### Batch 1 — Script and Code Injection (5 patterns)
31
32	\| # \| Category \| Regex Pattern \| Threat \|
33	\|---\|----------\|---------------\|--------\|
34	\| 1 \| Script tags \| `<script[^>]*>` \| Embedded JavaScript execution \|
35	\| 2 \| HTML Event Handlers \| `(onclick\\|onerror\\|onload\\|onmouseover\\|onfocus\\|onblur\\|onresize\\|onsubmit\\|onchange\\|oninput\\|onkeydown\\|onkeyup\\|onkeypress\\|ontouchstart\\|onmouseenter\\|onmouseleave)\s*=` \| Inline JS via HTML attributes \|
36	\| 3 \| JS/VBScript Protocol \| `(javascript:\\|vbscript:)` \| Malicious link protocols \|
37	\| 4 \| Dynamic Code Execution \| `(eval\s\(\\|Function\s\(\\|setTimeout\s\(\\|setInterval\s\()` \| Code execution via eval/setTimeout \|
38	\| 5 \| DOM Manipulation \| `(document\.(cookie\\|domain\\|write)\\|window\.(location\\|open)\\|XMLHttpRequest\\|fetch\s*\()` \| DOM-based attacks \|
39
40	### Batch 2 — Obfuscation and Encoding (6 patterns)
41
42	\| # \| Category \| Regex Pattern \| Threat \|
43	\|---\|----------\|---------------\|--------\|
44	\| 6 \| Base64 Payloads \| `(base64\\|atob\\|btoa\\|b64decode\\|b64encode)[\s(]` \| Encoded malicious content \|
45	\| 7 \| Data URI Injection \| `data:\s*(text/html\\|application/javascript\\|text/javascript)` \| Inline HTML/JS via data URIs \|
46	\| 8 \| SVG Injection \| `<svg[^>]*>` \| SVG-based XSS vectors \|
47	\| 9 \| Hex/Unicode Encoding \| `(\\x[0-9a-fA-F]{2}\\|\\u[0-9a-fA-F]{4}\\|&#x[0-9a-fA-F]+;)` \| Obfuscated character encoding \|
48	\| 10 \| Hidden Text — display:none \| `<(span\\|div\\|p)[^>]style\s=\s['"][^'"]display\s:\snone` \| Hidden content tricks \|
49	\| 11 \| Hidden Text — font-size:0 \| `font-size\s:\s0` \| Invisible text \|
50
51	### Batch 3 — Injection Vectors (7 patterns)
52
53	\| # \| Category \| Regex Pattern \| Threat \|
54	\|---\|----------\|---------------\|--------\|
55	\| 12 \| HTML Tag Injection \| `<(iframe\\|embed\\|object\\|link\\|meta\\|form\\|input\\|textarea\\|button)[\s>]` \| Injected HTML elements \|
56	\| 13 \| Suspicious Markdown Links \| `\[.?\]\(data:` then `\[.?\]\(javascript:` then `\[.*?\]\(vbscript:` \| Malicious link targets \|
57	\| 14 \| Prompt Injection (NL) \| `(?i)(ignore\s+(all\s+)?previous\s+instructions\\|you\s+are\s+now\\|forget\s+(all\s+)?previous\\|system\s:\syou\s+are\\|disregard\s+(all\s+)?prior\\|override\s+(all\s+)?instructions\\|new\s+instructions?:\\|IMPORTANT:.*ignore\\|do\s+not\s+follow)` \| AI/LLM prompt hijacking \|
58	\| 15 \| Prompt Injection (Token) \| `(?i)(\[INST\]\\|\[\/INST\]\\|<\\|im_start\\|>\\|<\\|im_end\\|>\\|<\\|system\\|>\\|<\\|user\\|>\\|<\\|assistant\\|>\\|Human:\\|Assistant:\\|###\sSystem\sPrompt\\|BEGIN\s+HIDDEN\\|END\s+HIDDEN)` \| LLM token format injection \|
59	\| 16 \| Shell Command Injection \| `(curl\s+\\|wget\s+\\|bash\s+-c\\|sh\s+-c\\|powershell\\|cmd\.exe\\|/bin/sh\\|/bin/bash\\|rm\s+-rf\\|chmod\s+777\\|sudo\s+)` \| Shell command execution \|
60	\| 17 \| Executable File Links \| `(https?://[^\s)>\]]*\.(exe\\|bat\\|cmd\\|ps1\\|sh\\|msi\\|dll\\|vbs\\|wsf\\|hta\\|scr))` \| Links to malicious executables \|
61	\| 18 \| Malware Keywords \| `(?i)(steganograph\\|obfusc\\|malware\\|payload\\|exploit\\|backdoor\\|trojan\\|keylog\\|ransom\\|phish)` \| Direct malware references \|
62
63	### Subagent Prompt Templates
64
65	Use 3 subagents via `use_subagents`, each with prompts corresponding to their batch patterns above. Replace `[TARGET_DIR]` with the actual target directory.
66
67	Subagent 1 — Script and Code Injection:
68	```
69	Search for script and code injection patterns in .md files in "[TARGET_DIR]". Use search_files with these regex patterns on *.md files, one at a time:
70	1. `<script[^>]*>`
71	2. `(onclick\|onerror\|onload\|onmouseover\|onfocus\|onblur\|onresize\|onsubmit\|onchange\|oninput\|onkeydown\|onkeyup\|onkeypress\|ontouchstart

People who liked this also viewed

6 picks

Type