T09 · Insecure Skill Coding Practices
Error
- Location
scripts/convert.py:126- Finding
Untrusted Markdown Is Rendered with Local File Access and Network Resource Loading
- Content
View full analysis
- Remediation
View remediation
Security audit
Markdown to PDF
Security checks for vulnerabilities and agentic risk
Overview
This Markdown-to-PDF skill does what it claims, but its converter gives the PDF renderer broad local file access when processing Markdown, which users should review carefully.
Install only if you will convert Markdown files you trust, or run the converter in a restricted environment. Be cautious with Markdown from other people, because embedded HTML or resource links may cause wkhtmltopdf to access local files or network resources available to your account.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:20- Finding
Third-Party Dependencies Are Installed Without Version or Integrity Constraints
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documentation indicates capabilities that require reading local files and invoking shell commands, but it does not declare any tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may execute the skill with broader access than users or policy expect, increasing the risk of unintended file access or command execution.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
pip install markdown pygments
You also need wkhtmltopdf installed:
macOS: brew install wkhtmltopdf
Ubuntu/Debian: sudo apt install wkhtmltopdf
text ## Usage
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The converter renders attacker-controlled Markdown into HTML and then calls wkhtmltopdf with --enable-local-file-access, allowing the renderer to load local files referenced by the generated HTML. If untrusted Markdown is processed, embedded file:// references or related local resource loads could expose sensitive local files in the generated PDF or to the rendering process, which is especially risky in an automated agent context that may have access to secrets or workspace data.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python output_path ] result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f"❌ Error generating PDF: {result.stderr}")