Markdown to PDF

• Outcome: Review
• Latest audit: May 29, 2026, 9:27 PM
• Version:
  1.0.0

Overview

This is a real Markdown-to-PDF converter, but it needs review because it enables the PDF renderer to read local files without clearly warning or limiting that behavior.

Install only if you plan to convert Markdown and CSS you trust, or can run it in a sandboxed environment. Avoid using it on documents from other people unless local file access is removed or tightly restricted, because crafted Markdown could cause local files to appear in the generated PDF.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and documents file reading and shell-based execution through `python3 scripts/convert.py` and `wkhtmltopdf`, but it does not declare corresponding permissions. Undeclared capabilities reduce transparency and can cause the agent or user to invoke filesystem and subprocess behavior without appropriate review, which is risky for a conversion skill that processes local files and writes outputs.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The converter renders attacker-controlled Markdown as HTML and then invokes wkhtmltopdf with --enable-local-file-access, which allows the rendered document to load local files via file:// URLs or similar references. In a skill that converts untrusted documents, this can expose arbitrary local file contents from the host environment into the generated PDF or outbound requests, making the context especially dangerous.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The description is broad enough that the skill could be invoked for many generic document tasks without clear constraints, increasing the chance of unintended use on sensitive local files. In context this is not inherently malicious, but broad triggers combined with file and shell capabilities make accidental overreach more plausible.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The skill documentation describes conversion behavior but omits a clear warning that it writes a PDF file to disk. Even though this is expected functionality, failing to disclose side effects can surprise users, overwrite files, or cause data to be written into unintended locations.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The conversion flow quietly enables filesystem access during rendering without any warning or trust boundary, so users may assume a simple format conversion while the renderer can access host-local resources referenced by document content. Because this skill is specifically intended to process Markdown files for sharing and documentation, it is likely to receive untrusted input, which increases the likelihood of abuse.

VirusTotal

66/66 vendors flagged this skill as clean.