Markdown Anything

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:46 PM UTC
• Version: 1.0.0

Overview

This skill clearly converts user-chosen files through the Markdown Anything API and includes a disclosed credit-balance helper, with no evidence of persistence, hidden execution, or unrelated data access.

Install only if you are comfortable sending selected files to Markdown Anything for processing and using an MDA_API_TOKEN in this environment. Prefer a limited-scope or revocable token, and be aware that the current scripts pass the bearer token through curl command-line arguments, which may be visible to local process observers while a request is running.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/convert.sh:17
• Finding: API Token Exposed Through Curl Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/convert.sh`, lines 17-34; `scripts/credits.sh`, lines 9-12 **Vulnerability Type**: Bearer token exposure through process command-line arguments **Risk Level**: Medium ### Vulnerable Code `scripts/convert.sh`, lines 17-23 and 34: ```bash CURL_ARGS=( --silent --fail --show-error -X POST -H "Authorization: Bearer ${MDA_API_TOKEN:?MDA_API_TOKEN is not set}" -F "file=@${FILE_PATH}" ) RESPONSE=$(curl "${CURL_ARGS[@]}" "https://markdownanything.com/api/v1/convert") ``` `scripts/credits.sh`, lines 9-12: ```bash RESPONSE=$(curl --silent --fail --show-error \ -H "Authorization: Bearer ${MDA_API_TOKEN:?MDA_API_TOKEN is not set}" \ "https://markdownanything.com/api/v1/credits") ``` ### Technical Analysis Both scripts expand `MDA_API_TOKEN` directly into a `curl` command-line argument. The shell therefore passes the complete `Authorization: Bearer ...` header as part of the process argument vector. While the request is active, locally authorized users or processes may be able to inspect the argument vector through process-monitoring facilities such as `ps` or `/proc/<pid>/cmdline`. The exact visibility depends on operating-system configuration, user boundaries, container isolation, and process-inspection restrictions. TLS protects the token while it is transmitted over the network, but it does not prevent this local command-line disclosure. ### Attack Path 1. An attacker obtains the ability to inspect processes belonging to the user running the skill, or otherwise has access permitted by the host's process-inspection policy. 2. The victim invokes `scripts/convert.sh` or `scripts/credits.sh`. 3. The attacker continuously monitors process argument vectors while waiting for a `curl` process. 4. The attacker captures the argument containing `Authorization: Bearer <token>`. 5. The attacker extracts and replays the token against the Markdown Anything API. 6. The attacker uses whateve ...[truncated 780 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Avoid placing the bearer token directly in `curl` command-line arguments. 1. Supply the sensitive header through a protected `curl` configuration stream or file descriptor instead of `-H` in the visible argument vector. 2. If a temporary configuration file is necessary: - Create it with `mktemp`. - Set restrictive permissions with `chmod 600`. - Register a `trap` to delete it on normal exit, errors, and signals. - Store it only in a trusted local directory. 3. Prevent tracing and accidental logging around secret handling. 4. Run the scripts under a dedicated least-privileged account and restrict cross-process inspection where supported. 5. Ensure API tokens have minimum required permissions, short validity periods where possible, and a documented rotation and revocation procedure. 6. Rotate the token if there is reason to believe it has already been exposed. One possible hardening pattern is to provide configuration through standard input: ```bash RESPONSE=$( printf 'header = "Authorization: Bearer %s"\n' "$MDA_API_TOKEN" | curl --config - \ --silent --fail --show-error \ -X POST \ -F "file=@${FILE_PATH}" \ "https://markdownanything.com/api/v1/convert" ) ``` Before adoption, verify on every supported platform that the configuration contents do not appear in process listings, logs, or diagnostic output. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description says it converts files to Markdown, but it also provides a credits-checking capability that queries account information using the same API token. This behavior mismatch can mislead reviewers and users about what the skill does with credentials, reducing informed consent and masking unexpected data/account access.

External Script Fetching

High

• Category: Supply Chain

Content

CURL_ARGS+=(-F "optimize_tokens=true")
fi

RESPONSE=$(curl "${CURL_ARGS[@]}" "https://markdownanything.com/api/v1/convert")

SUCCESS=$(echo "$RESPONSE" | python3 -c "import sys, json; print(json.load(sys.stdin).get('success', False))" 2>/dev/null || echo "False")

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill exposes shell-executable scripts but does not declare any explicit tool scope or allowed-tools boundary in the skill manifest. That omission weakens reviewability and least-privilege controls, making it easier for the skill to execute commands in a broader shell context than users or hosts may expect.

Static analysis

No suspicious patterns detected.