fix: the scripts/check-markdown in check-markdown.js

[anupamme]

Summary

Fix high severity security issue in scripts/check-markdown.js.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	scripts/check-markdown.js:35
Assessment	Likely exploitable

Description: The scripts/check-markdown.js file accepts a command-line argument at process.argv[2] and passes it directly to path.resolve() without validation. An attacker can provide a malicious path like '../../../etc/passwd' to traverse outside the intended docs directory and access sensitive files on the filesystem.

Evidence

Exploitation scenario: An attacker with ability to invoke the script can pass a path traversal payload: node scripts/check-markdown.js '../../../etc/passwd'.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Changes

• scripts/check-markdown.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

---

Automated security fix by OrbisAI Security

[mynodebtc]

Thanks, but I'm closing this because it isn't a vulnerability.

process.argv[2] can only be set by whoever runs the script, and that person already has a shell on the machine. They could read /etc/passwd directly, so the script gives them nothing extra. Every caller (yarn docs:lint, the PR content check and the deploy workflow) runs it without arguments. The script also only reads .md files and never prints their contents: it reports file paths, line numbers and rule names, plus at most 60 characters of a flagged URI.

The path argument is there on purpose, for pointing the linter at test fixtures, so removing it would cost something and fix nothing.

[anupamme]

Thanks for the clarification. I agree that, in this context, process.argv[2] does not provide an additional privilege boundary violation, since invoking the script already requires the ability to execute commands in the environment.

The original finding was based on the path-flow pattern without sufficiently accounting for the script’s execution context and intended use of the path argument. I’ll consider this finding a false positive and won’t pursue the original fix.