File to Markdown Converter

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:14 PM UTC
• Version: 1.0.0

Overview

The skill does what it advertises, but it directs agents to send local and private files to an external conversion service without clear per-file consent or sensitivity safeguards.

Use this skill only for files and URLs you are authorized to send to markdown.new. Avoid confidential documents, regulated data, credentials, internal-only URLs, private keys, or business-sensitive files unless you have explicit approval and understand the service's retention and processing terms.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:148
• Finding: Unrestricted Disclosure of Private Local Files to an External Conversion Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:148-161`, `SKILL.md:232-238`, `SKILL.md:305-308`; corroborated by `readme.txt:43-49` **Vulnerability Type**: Transmission of sensitive local data to a third-party service without adequate authorization or privacy controls **Risk Level**: High ### Complete Vulnerable Snippets From `SKILL.md:148-161`: ```markdown ### 4️⃣ Upload Local File Use when file is not publicly accessible. ``` POST /convert multipart/form-data ``` Example: ```bash curl -s https://markdown.new/convert \ -F "file=@document.pdf" ``` ``` From `SKILL.md:232-238`: ```markdown ### File Upload Strategy Use `/convert` only if: * File is local * File is private * File requires authentication to access Otherwise always prefer URL conversion. ``` From `SKILL.md:305-308`: ```markdown | Input Type | Action | | --------------- | ---------------------- | | Public file URL | Use GET or POST | | Local file | Use POST /convert | ``` From `readme.txt:43-49`: ```text POST /convert Upload a local file when no public URL is available. Notes * Prefer URL conversion when possible for speed. * Use file upload only for private or local files. ``` ### Technical Analysis The Skill explicitly instructs an agent to transmit complete local files to `https://markdown.new/convert` using a multipart HTTP request. It specifically recommends this workflow for files that are private, local, or otherwise inaccessible to the remote service. Remote processing is intrinsic to the advertised cloud conversion functionality, but automatically selecting it for private files crosses the local trust boundary and is not protected by compensating controls. The instructions do not require: - Explicit, informed, per-file user consent before disclosure. - Confirmation that the user is authorized to disclose the file. - Classification or inspection of the file for credentials, personal data, regulated records, or propri ...[truncated 2626 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Default to local processing for private content** - Use an offline, sandboxed converter for local or confidential files. - Reserve the external API for public files or content explicitly approved for external processing. 2. **Require explicit, informed consent** - Before each upload, identify the exact file, destination domain, and fact that the complete contents will leave the local environment. - Require affirmative user confirmation rather than inferring consent from a generic conversion request. - Do not reuse consent across unrelated files or sessions. 3. **Add sensitivity and authorization checks** - Confirm that the user owns the file or is authorized to disclose it. - Block or warn on credentials, secrets, personal data, regulated records, and files from sensitive directories. - Never upload hidden configuration files, credential stores, private keys, environment files, or authentication material. 4. **Minimize transmitted data** - Permit users to select pages, sheets, ranges, or redacted copies. - Remove unnecessary metadata and confidential fields before transmission. - Upload only the minimum content needed for the requested conversion. 5. **Constrain file access** - Require an explicit path supplied or approved by the user. - Apply directory and extension allowlists. - Reject path traversal, symbolic-link escapes, device files, and unintended bulk-directory processing. 6. **Document third-party data handling** - Disclose the service operator, retention period, deletion process, subprocessors, processing locations, and whether submitted data may be used for training. - Do not claim that private uploads are safe unless those guarantees are verifiable. 7. **Harden network use** - Allow outbound requests only to the exact approved HTTPS origin. - Enforce certificate validation, request-size limits, timeouts, and bounded retries. - Avoid logging request b ...[truncated 253 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

External Transmission

Medium

• Category: Data Exfiltration

Content

Example:

```bash
curl -s "https://markdown.new/https://example.com/report.pdf"
```

---

• Confidence: 97% confidence
• Finding: This example embeds a target file URL directly into a request to markdown.new, causing the external service to fetch and process that resource. That behavior can expose sensitive URLs, trigger third-party access to private resources if not restricted, and leak contents beyond the user's expected trust boundary.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly instructs agents to upload local files or submit URLs to a third-party service, but it does not warn users that potentially sensitive files, document contents, or internal URLs will be transmitted off-platform for processing. This can lead to unintended disclosure of confidential data and privacy/compliance issues, especially in agent workflows that may automatically process user-provided files.

External Transmission

Medium

• Category: Data Exfiltration

Content

### JavaScript (Node.js)

```js
const res = await fetch("https://markdown.new/", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({

• Confidence: 96% confidence
• Finding: The JavaScript example performs a POST to an external service with a remote file URL, demonstrating off-platform transmission of potentially sensitive input. In an agent setting, this becomes more dangerous because automation may process arbitrary user content at scale, increasing the chance of accidental data leakage or SSRF-by-proxy against the third-party converter.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
import requests

res = requests.post(
    "https://markdown.new/",
    json={"url": "https://example.com/file.pdf"}
)

• Confidence: 90% confidence
• Finding: This duplicate finding points to the same Python snippet that posts a URL to an external service. Although expected for the feature, it is still security-relevant because agents may forward sensitive document locations or internal endpoints to a third party without adequate notice or filtering.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
import requests

res = requests.post(
    "https://markdown.new/",
    json={"url": "https://example.com/file.pdf"}
)

• Confidence: 90% confidence
• Finding: This duplicate finding points to the same Python snippet that posts a URL to an external service. Although expected for the feature, it is still security-relevant because agents may forward sensitive document locations or internal endpoints to a third party without adequate notice or filtering.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly supports converting remote URLs and uploading local files to https://markdown.new, but the description does not clearly warn users that their files, URLs, and potentially sensitive document contents are transmitted to a third-party external service. This can lead to unintentional data exfiltration, privacy violations, or policy noncompliance when users process confidential or internal material under the assumption that conversion is local.

Vague Triggers

Low

• Confidence: 81% confidence
• Finding: This plain-text skill description explains capabilities and endpoints, but it does not define specific activation phrases, boundaries, or exclusion conditions for when the skill should be invoked. In a skill catalog context, that lack of specificity can lead to unintended activation for generic file-conversion or document-processing requests.

Static analysis

No suspicious patterns detected.