markitdown

• Outcome: Review
• Latest audit: Sep 23, 2026 · 5:51 AM UTC
• Version: 0.1.0

Overview

This skill is a document-to-Markdown converter that clearly warns about local file access, optional external services, and plugin risks.

Install in an isolated environment, prefer only the MarkItDown extras needed for your file types, and treat converted Markdown as untrusted source text. Do not enable plugins, cloud OCR, Azure analysis, YouTube/audio transcription, or remote URI conversion for private documents unless you have approved the provider and data handling.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

# Security and Privacy

MarkItDown is a converter, not a sandbox. It performs file and network I/O with the privileges of the current process and loads parser dependencies for complex, attacker-controlled formats.

## Threat Model

Treat all of these as untrusted unless provenance is established:

- Paths, filenames, and URIs supplied by users or agents
- Uploaded PDFs, Office files, archives, notebooks, images, audio, and EPUBs
- HTTP response headers and redirects
- Installed plugins
- Markdown produced from external documents
- LLM/OCR responses

Potential impacts include:

- Reading arbitrary local files
- Server-side request forgery (SSRF)
- Access to loopback services or cloud metadata
- Archive/decompression bombs and memory exhaustion
- Parser vulnerabilities
- Credential or document exfi

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Instruction Override

High

• Category: Prompt Injection

Content

## Prompt Injection in Converted Content

Documents can contain text such as "ignore previous instructions," links to malicious resources, or commands disguised as analysis steps. Conversion preserves that content.

When Markdown is used with an agent or RAG system:

• Confidence: 80% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: This markdown file explicitly defines invocation triggers, so SQP-1 applies. Phrases like "convert to markdown" and especially "extract document content" are broad, and the catch-all "and similar intents" provides no clear scope or exclusion conditions, increasing the chance of unintended invocation from ordinary requests.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The top-level title presents the skill as Chinese-first ('文件转 Markdown'), and the document content is predominantly Chinese with only partial English glosses. This can create a locale expectation without explicitly offering the user a language choice or stating that responses should match user preference.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The manifest frames this skill as safe local conversion with an offline fallback for converting files to Markdown. This reference file documents network-capable features including HTTP(S) URI conversion, Azure Document Intelligence/Content Understanding endpoints, and LLM/image-description clients, which are not justified by the stated local/offline conversion purpose.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The documented `convert_uri()` behavior allows direct handling of `http:`, `https:`, `file:`, and `data:` URIs and explicitly states there is no application-level SSRF policy, download-size limit, or redirect allowlist. In a skill presented as safe local/offline document conversion, exposing or encouraging this broader URI-fetching path can enable server-side request forgery, local file access via `file:`, and memory exhaustion from unbounded downloads if user-controlled inputs reach it.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This section documents third-party plugin discovery and loading through entry points and CLI flags, which extends a simple file-conversion skill into executing externally supplied converter code. If plugin use is enabled in an environment where installed packages are not tightly controlled, an attacker could gain arbitrary code execution or introduce unsafe processing logic under the guise of document conversion.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The manifest emphasizes safe local conversion and an offline fallback, but the code explicitly recognizes audio formats that may trigger Google Web Speech. Even though gated by a flag later, this is a network-capable transcription feature that is not justified by a document conversion skill framed as local/offline ingestion.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The line states the system 'Prefers English, then an available language,' which encodes a language preference in natural-language documentation rather than offering a user choice. That can conflict with organizational language/locale policies requiring neutrality or explicit user opt-in.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/security.md:198