Security audit

Markdown → PDF Report

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent Markdown-to-PDF tool, but it needs Review because it makes chat upload of generated reports mandatory and documents multi-platform fan-out without clear confirmation controls.

Install only if you want generated reports and editable Markdown sources to be uploaded to chat as part of the normal workflow. For confidential reports, ask the agent to generate locally only or confirm the exact destination first, avoid target="all", and inspect any referenced /tmp helper script before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill clearly instructs use of shell commands, filesystem reads/writes, and environment manipulation, yet no permissions are declared. That mismatch is dangerous because it hides the true execution surface from any permission or review system and can cause the agent to perform broader local actions than users expect.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The documented behavior expands from Markdown-to-PDF conversion into sending messages and uploading attachments across external platforms. That scope expansion is risky because a document-generation skill can become an exfiltration or unsolicited-messaging channel, especially when it encourages automatic delivery after local file creation.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The skill explicitly documents multi-platform fan-out (including target="all") even though its stated purpose is document conversion. This introduces unnecessary outbound communication capability and raises the risk of accidental bulk sharing of sensitive reports beyond the intended recipient.

Vague Triggers

High

Confidence: 92% confidence
Finding: The trigger list is extremely broad and includes common phrases like 'PDF version', 'give me a PDF', and generic Chinese equivalents, which can cause the skill to activate for routine requests that merely mention PDF output. In an agent environment, overbroad auto-triggering can redirect unrelated tasks into local file generation and attachment workflows, increasing the chance of unintended data handling or execution of the wrong skill.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README advertises automatic delivery of both the generated PDF and the source Markdown to chat, but does not prominently warn that this transmits potentially sensitive report contents and editable source material. If the skill is used on confidential research, internal proposals, or fact-check drafts, users may unintentionally expose data through automatic attachment behavior.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The README explicitly states that both the generated Markdown and PDF will be automatically sent into the chat via a media-delivery mechanism. That creates a real privacy and data-handling risk because reports may contain sensitive research, internal analysis, or personal information, and users are not clearly warned or asked to confirm before transmission. In this skill context, the feature is useful for cross-device access, but it also makes accidental disclosure more likely because delivery is presented as the default and even as a required final step.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The trigger description includes broad phrases such as long-form analytical content and generic requests for PDF/report output, making activation boundaries fuzzy. Overbroad triggers are dangerous because they can cause the skill to activate in contexts where the user did not intend local file operations, dependency installation, or external delivery behaviors.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The usage guidance says to use this skill for vague categories like long analytical output or whenever the user may want it often, without clear consent boundaries. In context, that is more concerning because this skill also performs shell/file actions and may send attachments, so accidental invocation has a larger blast radius than a purely formatting-only skill.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The design explicitly makes automatic delivery of generated Markdown and PDF files to chat mandatory, prioritizing convenience over user consent and disclosure. That creates a real data-sharing risk because reports may contain sensitive research, fact-check drafts, internal proposals, or personal data, and sending them to a chat platform can expose them to unintended recipients, retention policies, or cross-device access without an explicit confirmation step.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.