api.flatmark.dev

This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.

The tool allows specifying an arbitrary `webhook_url` that will receive a POST containing the job's final state (which may include converted document content/markdown or a result_url). While HMAC signing is provided for integrity, there is no restriction on the destination domain, so a malicious or compromised caller could direct converted document contents to an attacker-controlled server. This is a normal feature for legitimate automation but should be flagged for review since it enables data to leave the user's control to any https/http endpoint.”

The `file.download_url` parameter accepts any public https URL, which the server will fetch. This is standard functionality for a document conversion tool, but combined with no apparent domain allow-list, it could be used for SSRF-style probing of internal/metadata endpoints if the backend does not restrict destinations. Worth confirming server-side URL validation exists.