360 Secure SkillHub
360 安全技能中心

Md Viewer

启动本地 Python Web 服务，把指定 .md 文件渲染为适合电子墨水屏阅读的网页，自动绑定局域网 IP，并输出带密码令牌、可在其他设备浏览器直接打开的分享链接；同时自述提供密码认证、CSP、路径屏蔽等安全措施。

hoangcongst
hoangcongst
热度 43.20
最近更新 2026-05-11 17:40:03
分类：效率依赖：代码执行 / 读写文件应用场景：文件转换 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add md-viewer
Metadata
name
md-viewer
description
LAN-accessible web viewer for Markdown files optimized for e-readers. Auto-binds to LAN IP for easy access. TRIGGER when user says "cho tôi xem", "show me", "mở file", "view file", "xem md", "xem file này", or wants to review a .md file. Instead of reading/summarizing, generate a LAN link for user to view directly in browser from any device on WiFi.

MD Viewer

Key Principle

When user says "show me the file", "view this file":

  • ❌ DO NOT read and summarize the content
  • ✅ DO generate LAN link for user to view directly

User wants to VIEW the file themselves, not hear a summary.

Security Features

  • ✅ Only .md files - Blocks all other file types
  • ✅ Blocked paths - Cannot access /etc, ~/.ssh, ~/.gnupg, etc.
  • ✅ Password protection - Auto-generated password with cookie auth (30 days)
  • ✅ XSS protection - HTML sanitized with bleach library
  • ✅ CSP headers - Content Security Policy enforced
  • ✅ Auto LAN IP binding - Binds to LAN IP automatically
  • ✅ Link sharing - Token in URL for one-time access, saves cookie for future
  • ✅ No caching - Files always refresh on page reload

Workflow

Step 1: Start Server (Auto-generates password and binds to LAN)

python3 ~/.openclaw/skills/md-viewer/scripts/server.py

Output:

============================================================
📄 MD Viewer Server Started
============================================================
Local:    http://localhost:8765
Network:  http://10.0.10.93:8765
------------------------------------------------------------
🔐 Password: a1b2c3d4e5f6
   ⚠️  SAVE THIS PASSWORD - Required for login!
============================================================

Step 2: Share Link

Links include password token for easy sharing:

http://10.0.10.93:8765/view?path=/path/to/file.md&token=PASSWORD

Step 3: Access

  1. Click link → Auto-authenticated via token
  2. Password saved to cookie (30 days)
  3. Future visits → Auto-authenticated via cookie

Server Options

python3 ~/.openclaw/skills/md-viewer/scripts/server.py [options]

Options:
  --host HOST          Host to bind (default: auto-detect LAN IP)
  --port PORT          Port (default: 8765)
  --password PASSWORD  Custom password (auto-generated if not set)
  --no-history         Disable history tracking for privacy
  --localhost          Bind to localhost only (no LAN access)

Blocked Paths

Automatically blocked:

  • System: /etc, /proc, /sys, /dev, /var/log
  • SSH: ~/.ssh/, id_rsa, id_dsa, etc.
  • GPG: ~/.gnupg/
  • Cloud: ~/.aws/, ~/.gcp/
  • Passwords: .netrc, .pgpass, .env
  • Certs: .pem, .key, .p12, .pfx

Features

  • Light theme (e-ink optimized)
  • Serif fonts for comfortable reading
  • High contrast for e-readers
  • Syntax highlighting
  • Mobile-friendly UI
  • History tracking (50 files, enabled by default)
  • Cookie-based authentication (30 days)
  • XSS protection with bleach
  • Auto LAN IP binding

Dependencies

pip3 install markdown bleach

Resources

scripts/

  • server.py - Web server with security features
  • md-link.py - Link generator helper