document-conversion

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:12 AM UTC
• Version: 1.9.19

Overview

The skill is a coherent document-conversion helper, but it asks users to configure an unpinned third-party MCP package that can process local files and remote URLs.

Review before installing. Use this only for documents and URLs you are comfortable sending through the configured MCP server, prefer local/native fallbacks for sensitive material when possible, and pin or otherwise verify markitdown-mcp before adding it to .mcp.json.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:95

Finding

Unpinned Third-Party MCP Package Execution via uvx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:95-110
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

> I cannot convert this {format} file without the markitdown
> MCP server. To enable conversion, add this to `.mcp.json`:
>
> ```json
> {
>   "mcpServers": {
>     "markitdown": {
>       "type": "stdio",
>       "command": "uvx",
>       "args": ["markitdown-mcp"]
>     }
>   }
> }
> ```

The same unsafe configuration is repeated in modules/fallback-tiers.md:99-105:

markdown

> **Option A**: Install markitdown-mcp by adding to
> `.mcp.json`:
> ```json
> {"mcpServers": {"markitdown": {"type": "stdio",
>   "command": "uvx", "args": ["markitdown-mcp"]}}}
> ```

Technical Analysis

The recommended MCP configuration invokes markitdown-mcp through uvx without pinning an exact reviewed version or verifying package integrity. Consequently, the code executed when the MCP server starts may differ from the package version available when this Skill was audited.

This creates a supply-chain trust boundary: compromise of the package, its publishing account, its package-index entry, or a transitive dependency could cause arbitrary third-party code to execute under the MCP process user's account. The Skill provides no lockfile, hash, signature, trusted-index restriction, or sandboxing requirement to constrain this risk.

Attack Path

1. A user attempts to process a format that has no native fallback.
2. The Skill directs the user to add the supplied MCP configuration to .mcp.json.
3. The application launches uvx with the unversioned package name markitdown-mcp.
4. uvx resolves package content available from the configured package source at execution time.
5. An attacker who has compromised the package, publisher, source, or dependency chain supplies a malicious release.
6. The malicious package executes when the MCP server starts, inheriting the filesystem, network, environmen ...[truncated 908 chars]

Remediation

View remediation

Remediation Suggestions

• Pin markitdown-mcp to an exact version that has been reviewed, rather than resolving an unconstrained release.
• Use a lockfile or equivalent mechanism to pin all transitive dependencies.
• Require package hashes or verified signatures where the package tooling supports them.
• Explicitly configure a trusted package index and disable unexpected fallback indexes to reduce dependency-confusion exposure.
• Review the pinned package and its dependency tree before publishing the configuration.
• Run the MCP server in a sandbox or container with:
  • Access only to documents explicitly selected for conversion.
  • No access to unrelated home-directory files or credential stores.
  • A minimal environment without unnecessary secrets.
  • Read-only filesystem access where possible.
  • Restricted outbound network access.
• Document a controlled upgrade process that reviews and repins new versions before deployment.
• Update both duplicated configuration examples so users are not directed to the unpinned form.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad, generic phrases such as 'documents', 'pdf', 'docx', and especially the sentence fragment 'a skill must ingest PDF, DOCX, or URL content'. Overly broad activation can cause this infrastructure skill to be invoked in unrelated contexts, increasing the chance that external content conversion and ingestion occurs unexpectedly, which expands the attack surface for prompt-injection or unsafe content handling in downstream workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guidance tells users to pass remote http:///https:// URLs directly to the MCP conversion tool and states that the MCP server fetches the resource, but it does not warn that doing so discloses the target URL and associated request metadata to that external service. In a document-conversion skill, this is a real privacy and data-handling weakness because users may submit sensitive or internal URLs without realizing they are being transmitted off-process or off-host.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.