Security audit

md2img

Security checks for vulnerabilities and agentic risk

Overview

This Markdown-to-PNG skill is mostly coherent, but it can automatically fetch remote image URLs and read absolute local image paths from Markdown without clear user-facing scoping.

Install only if you trust the Markdown you will render or are comfortable auditing image references first. For sensitive environments, avoid untrusted Markdown, prefer disabling image inlining when possible, and watch for embedded HTTP(S) URLs or absolute local paths.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no permissions, yet its documented behavior implies reading user-specified Markdown files and fetching or embedding image resources, which introduces filesystem read and network access capabilities. Missing permission declarations are dangerous because they hide the true trust boundary from the agent/runtime and can enable unintended data access or exfiltration through referenced resources.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a local Markdown-to-PNG converter, but it also appears capable of fetching remote images over HTTP/HTTPS and reading additional local image files referenced by Markdown for embedding. This expands the attack surface significantly: crafted Markdown can trigger outbound requests, leak metadata, or cause unauthorized local file inclusion into the generated image/output path.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill claims to be a local Markdown-to-PNG converter, but it will fetch remote HTTP(S) image URLs embedded in Markdown and inline them before rendering. This creates an unintended outbound network channel, enabling SSRF-style access to internal services, metadata endpoints, or user-tracking/exfiltration via attacker-controlled image references.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Network retrieval is not necessary for a local conversion utility and expands the attack surface significantly. An attacker can embed remote image URLs in Markdown to induce the tool to contact arbitrary endpoints, leaking network reachability information and potentially accessing sensitive internal resources from the host environment.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The code resolves absolute image paths directly and reads arbitrary local files referenced by Markdown <img src> values. While intended for image embedding, this still grants attacker-supplied content a filesystem read primitive against any readable path on the host, which can disclose sensitive local files if their contents are later rendered or propagated.

Static analysis

No suspicious patterns detected.