1coos-markdown-converter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:13 AM UTC
• Version: 1.0.1

Overview

This skill appears to do document-to-Markdown conversion, but it relies on unpinned runtime code and unsafe installer guidance that users should review before installing.

Review this skill before installing. Prefer installing uv through a trusted package manager or verified official instructions, and avoid running the curl-to-shell command blindly. Use it only on documents you are comfortable giving to a third-party conversion toolchain, and consider pinning or sandboxing markitdown before processing sensitive or untrusted files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:78
• Finding: Unverified Remote Installer Is Piped Directly into a Shell## Vulnerability Details **File Location**: `SKILL.md:78` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```markdown 1. **Check prerequisites**: Verify `uvx` is available. If not, instruct the user to install uv: `curl -LsSf https://astral.sh/uv/install.sh | sh` ``` ### Technical Analysis The installation instruction downloads a mutable script from an external URL and immediately pipes it into `sh`. The downloaded content is not displayed for review, pinned to a known release, or verified using a checksum or cryptographic signature. Although `astral.sh` appears to be the legitimate upstream domain for the required `uv` utility, the effective code executed by this instruction is not part of the audited project and can change after review. Compromise of the upstream hosting environment, delivery infrastructure, DNS resolution, or TLS trust chain could therefore turn this command into an arbitrary-code execution channel. Installing the prerequisite is relevant to the Skill, but direct execution of an unverified network response exceeds the minimum privileges and trust necessary to provide installation guidance. A safer approach would separate retrieval from execution and require verification. ### Attack Path 1. A user invokes the Skill on a system where `uvx` is unavailable. 2. The Agent follows `SKILL.md` and presents or executes the documented installation command. 3. `curl` retrieves the current response from `https://astral.sh/uv/install.sh`. 4. The response is streamed directly to `sh` without integrity verification or user inspection. 5. If the remote response or delivery path has been compromised, attacker-controlled shell commands execute immediately. 6. Those commands operate with all permissions available to the user or Agent process that launched the shell. ### Impact Assessment Successful exploitation permits arbitrary command execution under the ...[truncated 517 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `curl | sh` instruction and link users to the official installation documentation instead. 2. Prefer a trusted operating-system package manager or another installation mechanism that provides package signing and version control. 3. If a standalone installer is required, download it without execution: ```bash curl -fL -o uv-install.sh https://astral.sh/uv/install.sh ``` 4. Pin the installer to a reviewed release rather than a mutable endpoint. 5. Verify a checksum or cryptographic signature published through an independent trusted channel. 6. Allow the user to inspect the downloaded file before running it. 7. Run installation without elevated privileges and document the files and directories that the installer will modify.

T08 · Insecure Dependencies

Warning

• Location: scripts/main.js:42
• Finding: Unpinned Third-Party Package Is Resolved and Executed at Runtime## Vulnerability Details **File Location**: `scripts/main.js:42-46` and `SKILL.md:5` **Vulnerability Type**: Insecure dependency resolution **Risk Level**: Medium **Vulnerable Code**: ```javascript const args = ["uvx", "markitdown[all]", inputPath]; if (fullConfig.charset) { args.push("-c", fullConfig.charset); } try { const proc = Bun.spawn(args, { ``` The corresponding dependency declaration is also unpinned: ```yaml metadata: {"openclaw":{"requires":{"bins":["bun","uvx"]},"install":[{"kind":"uv","package":"markitdown[all]","bins":["markitdown"]}],"emoji":"📝"}} ``` ### Technical Analysis The Skill invokes `uvx` with `markitdown[all]` but does not specify an exact package version, lockfile, or artifact hash. As a result, runtime dependency resolution may select a newer package release than the version originally reviewed. `uvx` executes the resolved Python application and may download and cache it when it is not already present. Because the dependency processes attacker-influenced input documents and runs as a local program, a compromised upstream release or package registry account could execute arbitrary code in the Skill's security context. The use of an argument array for `Bun.spawn` prevents the input path from being interpreted as shell syntax, so the audited code does not show shell command injection through `inputPath`. The risk instead comes from mutable executable dependency resolution. ### Attack Path 1. An attacker compromises the upstream `markitdown` release process, publishing account, or dependency supply chain. 2. A malicious or compromised package version becomes the version selected for the unpinned `markitdown[all]` requirement. 3. A user invokes the Skill, particularly on a system without a previously cached trusted version. 4. `uvx` resolves and retrieves the current package and its optional dependencies. 5. `Bun.spawn` executes the retrieved package to process the supplied ...[truncated 752 chars]
• Remediation: ## Remediation Suggestions 1. Pin `markitdown` to an exact reviewed version in both Skill metadata and runtime invocation, for example using the version syntax supported by `uvx`. 2. Maintain a lockfile or locked Python environment containing all transitive dependencies. 3. Require hash verification for downloaded distributions where supported. 4. Resolve and install dependencies during a controlled installation phase rather than dynamically during ordinary document conversion. 5. Review package updates before changing the pinned version. 6. Run the converter in a sandbox with only the input file and intended output directory mounted. 7. Restrict network access during conversion unless the selected input type explicitly requires network access. 8. Avoid exposing unnecessary credentials or sensitive environment variables to the converter subprocess.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger description is very broad, covering many document-conversion and formatting requests without clear boundaries. In an agent setting, overly broad activation increases the chance the skill runs on unintended inputs such as untrusted files, sensitive documents, or ambiguous requests, expanding the attack surface for risky file parsing and external-tool invocation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The skill instructs use of `uvx markitdown[all]` without pinning a specific package version, which means future executions may pull whatever release is current at runtime. That creates a supply-chain risk: a compromised upstream release or breaking update could execute unreviewed code in the user's environment when the skill runs.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The documentation instructs users to run `uvx markitdown[all]` without pinning a specific version, which can cause execution of newly published or compromised package versions at runtime. In an agent skill that converts untrusted files and may be used in automated workflows, this increases supply-chain risk because behavior can change unexpectedly or malicious code could be introduced through an upstream release.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill's stated purpose is file conversion and Markdown formatting, but the implementation invokes system binaries using Bun.spawn to probe for and later run external tools. Spawning subprocesses is a broader capability than a typical document formatter/converter needs to expose directly, and it is not declared in the manifest description.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence
• Finding: uvx/uv tool run commands without ==version create a rug-pull risk.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill delegates file conversion to an external tool via 'uvx markitdown[all]' on user-supplied files. In this skill context, that is materially risky because markitdown[all] may invoke a large set of parsers/OCR/transcription handlers for complex formats, expanding the attack surface to external packages and native tooling; using uvx also means behavior depends on whatever package version is resolved at runtime.

External Script Fetching

Low

• Category: Supply Chain

Content

When the user invokes this skill:

1. **Check prerequisites**: Verify `uvx` is available. If not, instruct the user to install uv: `curl -LsSf https://astral.sh/uv/install.sh | sh`
2. **Run conversion**: Execute the script:
   ```bash
   bun run ${CLAUDE_SKILL_DIR}/scripts/main.ts $ARGUMENTS

• Confidence: 93% confidence
• Finding: The skill tells users to install a dependency by piping a remotely fetched script directly into `sh`, which executes network-delivered code without prior verification. If the source, transport, DNS, or hosting path were compromised, this could lead to arbitrary code execution on the user's machine.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: This markdown file contains user-facing instructions exclusively in Chinese across the full document. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale/language policy issue when no choice or justification is provided.

Static analysis

No suspicious patterns detected.