markdown-injection-scanner

name	markdown-injection-scanner
type	workflow
description	Scans Markdown (.md) files for malicious code injection including XSS, prompt injection, script injection, obfuscated payloads, and supply chain attack vectors. Use when auditing .md files for security threats or when the user mentions scanning markdown for malicious content.
context	fork
agent	security-engineer
when_to_use	When scanning .md files for injection attacks, prompt injection, embedded malware, or when auditing documentation files for security threats
allowed-tools	Read, Glob, Grep, Bash
argument-hint	[target directory path]
user-invocable	true
effort	3

Markdown Injection Scanner

Scans all .md files in a target directory for 18 categories of malicious code injection. Uses regex pattern matching across the entire file corpus with parallel subagent execution for speed.

Usage

/markdown-injection-scanner [target-directory]

If no directory is specified, ask the user to provide one.

---

Phase 1: Discovery — Map the File Corpus

1. Count all .md files in target directory (recursive).

2. Sample 2-3 files to understand the file structure and content type (design docs, documentation, config, etc.).

3. Report file count and content type before proceeding.

---

Phase 2: Parallel Injection Scanning

Execute scans in 3 parallel batches using subagents for speed. Each subagent uses search_files with the target directory path and *.md file pattern.

Batch 1 — Script and Code Injection (5 patterns)

#	Category	Regex Pattern	Threat
1	Script tags	<script[^>]*>	Embedded JavaScript execution
2	HTML Event Handlers	(onclick|onerror|onload|onmouseover|onfocus|onblur|onresize|onsubmit|onchange|oninput|onkeydown|onkeyup|onkeypress|ontouchstart|onmouseenter|onmouseleave)\s*=	Inline JS via HTML attributes
3	JS/VBScript Protocol	(javascript:|vbscript:)	Malicious link protocols
4	Dynamic Code Execution	(eval\s*\(|Function\s*\(|setTimeout\s*\(|setInterval\s*\()	Code execution via eval/setTimeout
5	DOM Manipulation	(document\.(cookie|domain|write)|window\.(location|open)|XMLHttpRequest|fetch\s*\()	DOM-based attacks

Batch 2 — Obfuscation and Encoding (6 patterns)

#	Category	Regex Pattern	Threat
6	Base64 Payloads	(base64|atob|btoa|b64decode|b64encode)[\s(]	Encoded malicious content
7	Data URI Injection	data:\s*(text/html|application/javascript|text/javascript)	Inline HTML/JS via data URIs
8	SVG Injection	<svg[^>]*>	SVG-based XSS vectors
9	Hex/Unicode Encoding	(\\x[0-9a-fA-F]{2}|\\u[0-9a-fA-F]{4}|&#x[0-9a-fA-F]+;)	Obfuscated character encoding
10	Hidden Text — display:none	<(span|div|p)[^>]*style\s*=\s*['"][^'"]*display\s*:\s*none	Hidden content tricks
11	Hidden Text — font-size:0	font-size\s*:\s*0	Invisible text

Batch 3 — Injection Vectors (7 patterns)

#	Category	Regex Pattern	Threat
12	HTML Tag Injection	<(iframe|embed|object|link|meta|form|input|textarea|button)[\s>]	Injected HTML elements
13	Suspicious Markdown Links	\[.*?\]\(data: then \[.*?\]\(javascript: then \[.*?\]\(vbscript:	Malicious link targets
14	Prompt Injection (NL)	(?i)(ignore\s+(all\s+)?previous\s+instructions|you\s+are\s+now|forget\s+(all\s+)?previous|system\s*:\s*you\s+are|disregard\s+(all\s+)?prior|override\s+(all\s+)?instructions|new\s+instructions?:|IMPORTANT:.*ignore|do\s+not\s+follow)	AI/LLM prompt hijacking
15	Prompt Injection (Token)	(?i)(\[INST\]|\[\/INST\]|<|im_start|>|<|im_end|>|<|system|>|<|user|>|<|assistant|>|Human:|Assistant:|###\s*System\s*Prompt|BEGIN\s+HIDDEN|END\s+HIDDEN)	LLM token format injection
16	Shell Command Injection	(curl\s+|wget\s+|bash\s+-c|sh\s+-c|powershell|cmd\.exe|/bin/sh|/bin/bash|rm\s+-rf|chmod\s+777|sudo\s+)	Shell command execution
17	Executable File Links	(https?://[^\s)>\]]*\.(exe|bat|cmd|ps1|sh|msi|dll|vbs|wsf|hta|scr))	Links to malicious executables
18	Malware Keywords	(?i)(steganograph|obfusc|malware|payload|exploit|backdoor|trojan|keylog|ransom|phish)	Direct malware references

Subagent Prompt Templates

Use 3 subagents via use_subagents, each with prompts corresponding to their batch patterns above. Replace [TARGET_DIR] with the actual target directory.

Subagent 1 — Script and Code Injection:

Search for script and code injection patterns in .md files in "[TARGET_DIR]". Use search_files with these regex patterns on *.md files, one at a time:
1. `<script[^>]*>`
2. `(onclick|onerror|onload|onmouseover|onfocus|onblur|onresize|onsubmit|onchange|oninput|onkeydown|onkeyup|onkeypress|ontouchstart|onmouseenter|onmouseleave)\s*=`
3. `(javascript:|vbscript:)`
4. `(eval\s*\(|Function\s*\(|setTimeout\s*\(|setInterval\s*\()`
5. `(document\.(cookie|domain|write)|window\.(location|open)|XMLHttpRequest|fetch\s*\()`
Report all findings per pattern.

Subagent 2 — Obfuscation and Encoding:

Search for obfuscation and encoding patterns in .md files in "[TARGET_DIR]". Use search_files with these regex patterns on *.md files, one at a time:
1. `(base64|atob|btoa|b64decode|b64encode)[\s(]`
2. `data:\s*(text/html|application/javascript|text/javascript)`
3. `<svg[^>]*>`
4. `(\\x[0-9a-fA-F]{2}|\\u[0-9a-fA-F]{4}|&#x[0-9a-fA-F]+;)`
5. `<(span|div|p)[^>]*style\s*=\s*['"][^'"]*display\s*:\s*none`
6. `font-size\s*:\s*0`
Report all findings per pattern.

Subagent 3 — Injection Vectors:

Search for injection vectors in .md files in "[TARGET_DIR]". Use search_files with these regex patterns on *.md files, one at a time:
1. `<(iframe|embed|object|link|meta|form|input|textarea|button)[\s>]`
2. `\[.*?\]\(data:` then `\[.*?\]\(javascript:` then `\[.*?\]\(vbscript:`
3. `(?i)(ignore\s+(all\s+)?previous\s+instructions|you\s+are\s+now|forget\s+(all\s+)?previous|system\s*:\s*you\s+are|disregard\s+(all\s+)?prior|override\s+(all\s+)?instructions|new\s+instructions?:|IMPORTANT:.*ignore|do\s+not\s+follow)`
4. `(?i)(\[INST\]|\[\/INST\]|<\|im_start\|>|<\|im_end\|>|<\|system\|>|<\|user\|>|<\|assistant\|>|Human:|Assistant:|###\s*System\s*Prompt|BEGIN\s+HIDDEN|END\s+HIDDEN)`
5. `(curl\s+|wget\s+|bash\s+-c|sh\s+-c|powershell|cmd\.exe|/bin/sh|/bin/bash|rm\s+-rf|chmod\s+777|sudo\s+)`
6. `(https?://[^\s)>\]]*\.(exe|bat|cmd|ps1|sh|msi|dll|vbs|wsf|hta|scr))`
7. `(?i)(steganograph|obfusc|malware|payload|exploit|backdoor|trojan|keylog|ransom|phish)`
Report all findings per pattern.

---

Phase 3: Sample Review

If any patterns matched in Phase 2, read the flagged files to:

1. Confirm the match is a true positive (not just a URL or benign text)
2. Assess severity of the injection
3. Identify the exact location and content

If zero patterns matched, skip to Phase 4.

---

Phase 4: Report Findings

Output Format

# Markdown Injection Scan Report — [TARGET_DIR]

## Summary
- **Files scanned:** [count]
- **Patterns checked:** 18
- **Threats found:** [count]
- **Verdict:** CLEAN | LOW RISK | MEDIUM RISK | HIGH RISK

## Results Matrix

| # | Category | Pattern | Matches | Severity |
|---|----------|---------|---------|----------|
| 1 | Script tags | <script> | 0 | — |
| ... | ... | ... | ... | ... |

## Detailed Findings (if any)

| Severity | Category | File:Line | Content | Remediation |
|----------|----------|-----------|---------|-------------|
| P0/P1/P2/P3 | ... | ... | ... | ... |

## Sample File Review
- Files reviewed: [list]
- Structure: [description]
- Suspicious content: [none / details]

Severity Guide

• P0 Critical: Active script tags, eval(), javascript: protocol in links, command injection
• P1 High: Prompt injection, SVG injection, data URI injection, HTML event handlers
• P2 Medium: Base64 payloads, suspicious URLs, obfuscated content
• P3 Low/Info: Malware keywords in text, hidden HTML elements

---

Phase 5: Save Report

Ask user permission before saving:

"May I write the report to docs/security/markdown-injection-scan-{YYYY-MM-DD}.md?"

---

Protocol

• Question: Reads target directory from argument
• Options: Skip — proceed directly if directory is provided
• Decision: Run all 18 patterns via 3 parallel subagents
• Draft: Results matrix shown in conversation before saving
• Approval: Ask before writing report file

Related Skills

• security-audit — comprehensive OWASP/infrastructure security audit for codebases
• code-review — code-level review with security considerations
• guard — freeze check before deploying security fixes