md2word

• Outcome: Review
• Latest audit: Aug 5, 2026 · 3:01 PM UTC
• Version: 1.2.0

Overview

This Markdown-to-Word skill is mostly purpose-aligned, but it defaults to broad network fetching and runs document-derived rendering through local external tools without strong containment.

Install only if you will convert trusted Markdown or can run it in a constrained environment. Be aware that documents can cause outbound HTTP/HTTPS requests, embed reachable local image files, and invoke local rendering tools; avoid using it on untrusted third-party Markdown unless network egress and filesystem access are sandboxed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (17)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["-c", cfg])

        print(f"🔧 执行命令: {' '.join(cmd)}")
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)

        if result.returncode != 0:
            print(f"⚠️ mmdc 命令执行失败: {result.stderr}")

• Confidence: 95% confidence
• Finding: The code executes an external program via subprocess.run, and the executable path can be influenced by MMDCCMD from the environment or by PATH resolution. Although shell=True is not used, this still permits execution of an attacker-controlled binary if the runtime environment is manipulated, which is dangerous in agent or plugin deployments where environment variables may be user-influenced or weakly isolated.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if shutil.which('node') and os.path.exists(svg2png_js):
        try:
            dpi = int(96 * zoom)
            r = subprocess.run(['node', svg2png_js, svg_path, png_path, str(dpi)],
                               capture_output=True, text=True, timeout=60)
            if r.returncode == 0 and os.path.exists(png_path):
                return png_path

• Confidence: 81% confidence
• Finding: Although the Node command is invoked without a shell, it hands attacker-controlled SVG content to a Node/Puppeteer renderer, which expands the attack surface substantially. Rendering untrusted SVG via a browser engine can enable SSRF, unexpected network/file access, or exploitation of parser/renderer vulnerabilities in the local Node/Chromium toolchain.

Tainted flow: 'cmd' from os.environ.get (line 99, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

cmd.extend(["-c", cfg])

        print(f"🔧 执行命令: {' '.join(cmd)}")
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)

        if result.returncode != 0:
            print(f"⚠️ mmdc 命令执行失败: {result.stderr}")

• Confidence: 99% confidence
• Finding: There is a direct tainted flow from os.environ.get('MMDCCMD') into the command executed by subprocess.run. An attacker who can set or influence that environment variable can cause the process to run an arbitrary executable, leading to code execution under the privileges of this skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation indicates capabilities to read environment variables, access files, invoke external executables, and perform outbound network requests, but these permissions are not explicitly declared in a structured way. This creates a real security gap because users or orchestration systems may treat the skill as lower risk than it is, increasing the chance of unexpected shell execution or SSRF-capable network activity during normal use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The stated purpose is Markdown-to-Word conversion, but the documented behavior includes additional high-risk operations: arbitrary HTTP/HTTPS fetching, external process execution for Mermaid/SVG rendering, template extraction, and multi-file document assembly. In context, these hidden or under-emphasized capabilities materially expand the attack surface, enabling SSRF, resource exhaustion, and unsafe processing of untrusted content beyond what a user would reasonably expect from a simple document formatter.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill is described as a Markdown-to-Word converter, but it will fetch arbitrary remote image URLs embedded in the Markdown during conversion. That creates an unexpected network side effect: attacker-controlled documents can trigger outbound requests, leak IP/network metadata, and probe access to internal-only endpoints if the converter runs in a trusted environment.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The Markdown image handling path automatically treats http/https image targets as downloadable resources and retrieves them without a trust boundary check. Because the URLs come from document content, an attacker can weaponize a Markdown file to cause network egress and potential SSRF-style access when processed by an automated agent or a user on an internal network.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The script renders attacker-controlled SVG inside a full Chromium instance with `--no-sandbox` and related sandbox-disabling flags. SVG can reference external resources and exercise complex browser parsing paths, so removing the browser sandbox turns a renderer compromise or unintended network/file access into a much higher-risk local code execution or data exposure path.

Description-Behavior Mismatch

High

• Confidence: 88% confidence
• Finding: The file implements SVG-to-PNG conversion even though the skill is described as Markdown-to-Word conversion, which is a capability mismatch. Hidden or undocumented functionality is dangerous because it expands the attack surface beyond user expectations and can introduce risky components like headless browsers into environments that did not intend to permit them.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The HTML table image handling explicitly accepts file:// URLs and absolute filesystem paths, then checks os.path.exists() and embeds the referenced local file into the generated Word document. If untrusted Markdown/HTML is converted, an attacker can cause unintended local file inclusion from the host running the conversion, which exceeds normal document-formatting behavior and can expose sensitive local content.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This regression test explicitly preserves and validates remote image downloading as default behavior in a Markdown-to-Word conversion skill. Even though the issue is only evidenced in test code, it strongly indicates the product intentionally performs outbound network fetches on untrusted Markdown input, which can enable SSRF, internal network probing, metadata service access, and privacy leaks when documents contain attacker-controlled image URLs.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The comment and assertion reinforce that external image downloading should remain enabled by default, signaling a deliberate design choice that expands the skill beyond local document formatting into network activity. In the context of processing untrusted Markdown, this increases risk because attackers can embed remote image references that trigger unintended outbound requests and possible access to sensitive internal endpoints.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The design explicitly supports downloading external images over HTTP/HTTPS during conversion, which can trigger outbound network requests based on untrusted Markdown content. This creates SSRF/privacy risks, including contacting attacker-controlled URLs, leaking IP/network metadata, or accessing internal resources if URL validation is weak or absent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly advertises automatic embedding of external URL images but does not warn that conversion may perform outbound network requests. Processing attacker-controlled Markdown can therefore cause unintended requests to third-party servers, leaking IP address, timing, user agent, and possibly internal network reachability information, which is a real security and privacy concern in an agent or enterprise environment.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Remote image downloads are triggered from document-derived URLs with no explicit consent or warning, so simply converting an untrusted Markdown file can disclose the operator's IP address and request metadata to third parties. In agent or batch-processing environments, this also enables silent outbound traffic that users may not realize the skill performs.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The test preserves silent external image downloading without any evidence of user-facing warning or consent, which is unsafe for a document conversion tool handling potentially untrusted Markdown. Lack of disclosure makes exploitation more likely in practice because users may not realize conversion can initiate outbound requests, exposing their environment, IP address, or internal services to attacker-supplied URLs.

Unvalidated Output Injection

High

• Category: Output Handling

Content

if rsvg:
        try:
            cmd = [rsvg, '-z', str(zoom), '-o', png_path, svg_path]
            r = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
            if r.returncode == 0 and os.path.exists(png_path):
                return png_path
            print(f"⚠️  rsvg-convert 渲染失败: {(r.stderr or '').strip()}")

• Confidence: 88% confidence
• Finding: The module writes untrusted inline SVG to disk and then renders it with external engines, creating an output-processing vulnerability even though there is no shell injection. Malicious SVG can reference remote resources, local files, or trigger vulnerable parser behavior in librsvg/cairosvg/browser-based renderers, which is especially relevant because this skill converts user-supplied Markdown content.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.