Markdown Exporter

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Markdown conversion skill whose main risk is ordinary file creation or overwrite at paths the user chooses.

Install only if you trust the md-exporter package and publisher. Use a dedicated output folder, verify input and output paths before running commands, and avoid pointing outputs at important existing files unless replacement is intended.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill repeatedly documents commands that write files, directories, ZIPs, and converted outputs to user-supplied paths, but it does not warn that existing files may be overwritten or modified. In an agent context, this is dangerous because an LLM or automation may choose output paths incorrectly and unintentionally clobber user data, especially when batch-generating multiple files or archives.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal