anything-to-skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:01 AM UTC
• Version: 0.2.0

Overview

This skill is a transparent document-to-skill workflow, but users should be careful about installing and running its external CLI.

Install this only if you intend to create reusable skills from specific sources. Review and verify the external anything-to-skill CLI before running it, keep crawls limited to the documentation you actually want, and inspect any generated skill before loading it because generated skills can affect future agent behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned External CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–34
Vulnerability Type: Unpinned third-party dependency and unverified release artifact
Risk Level: Medium

Vulnerable Code

markdown

If that fails, the CLI is not installed. Tell the user, with the install line
for their platform, and stop — there is no fallback path:

```text
cargo install anything-to-skill
# or download a release binary:
# https://github.com/asale-ai/anything-to-skill/releases

text

### Technical Analysis

The skill requires users or agents to install and execute an external `anything-to-skill` CLI that is not included in the audited project. The Cargo command does not pin a specific version or require a locked dependency graph. The release-binary alternative also does not identify a fixed release or require checksum or signature verification.

As a result, the code ultimately executed by the documented `check`, `extract`, and `render` commands can change after this skill has been reviewed. The risk becomes exploitable if the package registry account, upstream repository, release artifacts, or transitive dependency chain is compromised. This audit found no evidence that the currently referenced project is malicious; the finding concerns the unsafe dependency acquisition process.

### Attack Path

1. An attacker compromises the upstream package publisher, release account, distribution channel, or a dependency used by a future CLI release.
2. The attacker publishes a modified package or replaces a downloadable release artifact.
3. A user or agent follows `SKILL.md` and runs the unpinned `cargo install anything-to-skill` command or downloads an unverified release binary.
4. The malicious executable runs with the permissions of the invoking user when the skill calls `anything-to-skill --version`, `check`, `extract`, or `render`.
5. The executable can access inputs supplied for conversion and any other resources available to that operating-system account.

### Impac
...[truncated 513 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin a reviewed CLI version exactly and retain Cargo's resolved dependency versions:

   bash

   cargo install anything-to-skill --version '=X.Y.Z' --locked
   

2. Document the authoritative package identity, source repository, expected publisher, and reviewed commit or release tag.

3. Link directly to a fixed release rather than a mutable releases index.

4. Publish SHA-256 or stronger checksums for every release artifact and require verification before execution.

5. Prefer signed releases and document signature verification against a pinned maintainer key.

6. Re-audit the CLI and its locked transitive dependency graph whenever the pinned version is updated.

7. Where feasible, vendor the reviewed implementation or distribute the verified executable with the skill through a trusted, integrity-protected channel.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

md

The generated `SKILL.md` needs YAML frontmatter with `name` and a `description`

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill’s trigger description is extremely broad: it covers books, papers, documents, docs sites, and code repositories, with natural-language examples that overlap many common user requests. That increases the chance of unintended activation on loosely related prompts, causing the agent to fetch, read, or transform untrusted external content when the user did not clearly intend to invoke this powerful workflow.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

| A documentation site | `extract https://docs.example.com/guide/ --crawl` |
| A library's repository | `extract owner/repo` |

**Do not ask the user whether the book is "technical" or "text-heavy".** The
extractor routes per page on its own: it reconstructs multi-column reading
order, and re-renders pages whose tables the Markdown pass would flatten. There
is no mode to pick.

Static analysis

No suspicious patterns detected.