1coos-markdown-converter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:13 AM UTC
• Version: 1.0.1

Overview

This skill appears to do document-to-Markdown conversion, but it relies on unpinned runtime code and unsafe installer guidance that users should review before installing.

Review this skill before installing. Prefer installing uv through a trusted package manager or verified official instructions, and avoid running the curl-to-shell command blindly. Use it only on documents you are comfortable giving to a third-party conversion toolchain, and consider pinning or sandboxing markitdown before processing sensitive or untrusted files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:78

Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:78
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

markdown

1. **Check prerequisites**: Verify `uvx` is available. If not, instruct the user to install uv: `curl -LsSf https://astral.sh/uv/install.sh | sh`

Technical Analysis

The installation instruction downloads a mutable script from an external URL and immediately pipes it into sh. The downloaded content is not displayed for review, pinned to a known release, or verified using a checksum or cryptographic signature.

Although astral.sh appears to be the legitimate upstream domain for the required uv utility, the effective code executed by this instruction is not part of the audited project and can change after review. Compromise of the upstream hosting environment, delivery infrastructure, DNS resolution, or TLS trust chain could therefore turn this command into an arbitrary-code execution channel.

Installing the prerequisite is relevant to the Skill, but direct execution of an unverified network response exceeds the minimum privileges and trust necessary to provide installation guidance. A safer approach would separate retrieval from execution and require verification.

Attack Path

1. A user invokes the Skill on a system where uvx is unavailable.
2. The Agent follows SKILL.md and presents or executes the documented installation command.
3. curl retrieves the current response from https://astral.sh/uv/install.sh.
4. The response is streamed directly to sh without integrity verification or user inspection.
5. If the remote response or delivery path has been compromised, attacker-controlled shell commands execute immediately.
6. Those commands operate with all permissions available to the user or Agent process that launched the shell.

Impact Assessment

Successful exploitation permits arbitrary command execution under the ...[truncated 517 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh instruction and link users to the official installation documentation instead.

2. Prefer a trusted operating-system package manager or another installation mechanism that provides package signing and version control.

3. If a standalone installer is required, download it without execution:

   bash

   curl -fL -o uv-install.sh https://astral.sh/uv/install.sh
   

4. Pin the installer to a reviewed release rather than a mutable endpoint.

5. Verify a checksum or cryptographic signature published through an independent trusted channel.

6. Allow the user to inspect the downloaded file before running it.

7. Run installation without elevated privileges and document the files and directories that the installer will modify.

T08 · Insecure Dependencies

Warning

• Location: scripts/main.js:42

Finding

Unpinned Third-Party Package Is Resolved and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location: scripts/main.js:42-46 and SKILL.md:5
Vulnerability Type: Insecure dependency resolution
Risk Level: Medium

Vulnerable Code:

javascript

const args = ["uvx", "markitdown[all]", inputPath];
if (fullConfig.charset) {
  args.push("-c", fullConfig.charset);
}
try {
  const proc = Bun.spawn(args, {

The corresponding dependency declaration is also unpinned:

yaml

metadata: {"openclaw":{"requires":{"bins":["bun","uvx"]},"install":[{"kind":"uv","package":"markitdown[all]","bins":["markitdown"]}],"emoji":"📝"}}

Technical Analysis

The Skill invokes uvx with markitdown[all] but does not specify an exact package version, lockfile, or artifact hash. As a result, runtime dependency resolution may select a newer package release than the version originally reviewed.

uvx executes the resolved Python application and may download and cache it when it is not already present. Because the dependency processes attacker-influenced input documents and runs as a local program, a compromised upstream release or package registry account could execute arbitrary code in the Skill's security context.

The use of an argument array for Bun.spawn prevents the input path from being interpreted as shell syntax, so the audited code does not show shell command injection through inputPath. The risk instead comes from mutable executable dependency resolution.

Attack Path

1. An attacker compromises the upstream markitdown release process, publishing account, or dependency supply chain.
2. A malicious or compromised package version becomes the version selected for the unpinned markitdown[all] requirement.
3. A user invokes the Skill, particularly on a system without a previously cached trusted version.
4. uvx resolves and retrieves the current package and its optional dependencies.
5. Bun.spawn executes the retrieved package to process the supplied ...[truncated 752 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin markitdown to an exact reviewed version in both Skill metadata and runtime invocation, for example using the version syntax supported by uvx.
2. Maintain a lockfile or locked Python environment containing all transitive dependencies.
3. Require hash verification for downloaded distributions where supported.
4. Resolve and install dependencies during a controlled installation phase rather than dynamically during ordinary document conversion.
5. Review package updates before changing the pinned version.
6. Run the converter in a sandbox with only the input file and intended output directory mounted.
7. Restrict network access during conversion unless the selected input type explicitly requires network access.
8. Avoid exposing unnecessary credentials or sensitive environment variables to the converter subprocess.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description is very broad, covering many document-conversion and formatting requests without clear boundaries. In an agent setting, overly broad activation increases the chance the skill runs on unintended inputs such as untrusted files, sensitive documents, or ambiguous requests, expanding the attack surface for risky file parsing and external-tool invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill instructs use of uvx markitdown[all] without pinning a specific package version, which means future executions may pull whatever release is current at runtime. That creates a supply-chain risk: a compromised upstream release or breaking update could execute unreviewed code in the user's environment when the skill runs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The documentation instructs users to run uvx markitdown[all] without pinning a specific version, which can cause execution of newly published or compromised package versions at runtime. In an agent skill that converts untrusted files and may be used in automated workflows, this increases supply-chain risk because behavior can change unexpectedly or malicious code could be introduced through an upstream release.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill's stated purpose is file conversion and Markdown formatting, but the implementation invokes system binaries using Bun.spawn to probe for and later run external tools. Spawning subprocesses is a broader capability than a typical document formatter/converter needs to expose directly, and it is not declared in the manifest description.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill delegates file conversion to an external tool via 'uvx markitdown[all]' on user-supplied files. In this skill context, that is materially risky because markitdown[all] may invoke a large set of parsers/OCR/transcription handlers for complex formats, expanding the attack surface to external packages and native tooling; using uvx also means behavior depends on whatever package version is resolved at runtime.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The skill tells users to install a dependency by piping a remotely fetched script directly into sh, which executes network-delivered code without prior verification. If the source, transport, DNS, or hosting path were compromised, this could lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

When the user invokes this skill:

1. Check prerequisites: Verify uvx is available. If not, instruct the user to install uv: curl -LsSf https://astral.sh/uv/install.sh | sh
2. Run conversion: Execute the script:

   bash

   bun run ${CLAUDE_SKILL_DIR}/scripts/main.ts $ARGUMENTS
   

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains user-facing instructions exclusively in Chinese across the full document. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale/language policy issue when no choice or justification is provided.

Content

No source excerpt is available for this finding.