markdown-injection-scanner

name	markdown-injection-scanner
type	workflow
description	Scans Markdown (.md) files for malicious code injection including XSS, prompt injection, script injection, obfuscated payloads, and supply chain attack vectors. Use when auditing .md files for security threats or when the user mentions scanning markdown for malicious content.
context	fork
agent	security-engineer
when_to_use	When scanning .md files for injection attacks, prompt injection, embedded malware, or when auditing documentation files for security threats
allowed-tools	Read, Glob, Grep, Bash
argument-hint	[target directory path]
user-invocable	true
effort	3

Markdown Injection Scanner

Scans all .md files in a target directory for 18 categories of malicious code injection. Uses regex pattern matching across the entire file corpus with parallel subagent execution for speed.

Usage

/markdown-injection-scanner [target-directory]

If no directory is specified, ask the user to provide one.

---

Phase 1: Discovery — Map the File Corpus

1. Count all .md files in target directory (recursive).

2. Sample 2-3 files to understand the file structure and content type (design docs, documentation, config, etc.).

3. Report file count and content type before proceeding.

---

Phase 2: Parallel Injection Scanning

Execute scans in 3 parallel batches using subagents for speed. Each subagent uses search_files with the target directory path and *.md file pattern.

Batch 1 — Script and Code Injection (5 patterns)

#	Category	Regex Pattern	Threat
1	Script tags	<script[^>]*>	Embedded JavaScript execution
2	HTML Event Handlers	(onclick|onerror|onload|onmouseover|onfocus|onblur|onresize|onsubmit|onchange|oninput|onkeydown|onkeyup|onkeypress|ontouchstart|onmouseenter|onmouseleave)\s*=	Inline JS via HTML attributes
3	JS/VBScript Protocol	(javascript:|vbscript:)	Malicious link protocols
4	Dynamic Code Execution	(eval\s*\(|Function\s*\(|setTimeout\s*\(|setInterval\s*\()	Code execution via eval/setTimeout
5	DOM Manipulation	(document\.(cookie|domain|write)|window\.(location|open)|XMLHttpRequest|fetch\s*\()	DOM-based attacks

Batch 2 — Obfuscation and Encoding (6 patterns)

#	Category	Regex Pattern	Threat
6