| name | markdown-injection-scanner |
| type | workflow |
| description | Scans Markdown (.md) files for malicious code injection including XSS, prompt injection, script injection, obfuscated payloads, and supply chain attack vectors. Use when auditing .md files for security threats or when the user mentions scanning markdown for malicious content. |
| context | fork |
| agent | security-engineer |
| when_to_use | When scanning .md files for injection attacks, prompt injection, embedded malware, or when auditing documentation files for security threats |
| allowed-tools | Read, Glob, Grep, Bash |
| argument-hint | [target directory path] |
| user-invocable | true |
| effort | 3 |
Markdown Injection Scanner
Scans all .md files in a target directory for 18 categories of malicious code injection.
Uses regex pattern matching across the entire file corpus with parallel subagent execution for speed.
Usage
/markdown-injection-scanner [target-directory]
If no directory is specified, ask the user to provide one.
Phase 1: Discovery — Map the File Corpus
-
Count all .md files in target directory (recursive).
-
Sample 2-3 files to understand the file structure and content type (design docs, documentation, config, etc.).
-
Report file count and content type before proceeding.
Phase 2: Parallel Injection Scanning
Execute scans in 3 parallel batches using subagents for speed. Each subagent uses search_files with the target directory path and *.md file pattern.
Batch 1 — Script and Code Injection (5 patterns)
| # | Category | Regex Pattern | Threat |
|---|
| 1 | Script tags | <script[^>]*> | Embedded JavaScript execution |
| 2 | HTML Event Handlers | (onclick|onerror|onload|onmouseover|onfocus|onblur|onresize|onsubmit|onchange|oninput|onkeydown|onkeyup|onkeypress|ontouchstart|onmouseenter|onmouseleave)\s*= | Inline JS via HTML attributes |
| 3 | JS/VBScript Protocol | (javascript:|vbscript:) | Malicious link protocols |
| 4 | Dynamic Code Execution | (eval\s*\(|Function\s*\(|setTimeout\s*\(|setInterval\s*\() | Code execution via eval/setTimeout |
| 5 | DOM Manipulation | (document\.(cookie|domain|write)|window\.(location|open)|XMLHttpRequest|fetch\s*\() | DOM-based attacks |
Batch 2 — Obfuscation and Encoding (6 patterns)
| # | Category | Regex Pattern | Threat |
|---|
| 6 |
