md2word

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:11 AM UTC
• Version: 1.2.0

Overview

This Markdown-to-Word skill does what it claims, but it processes document content with broad default network, local-file, and SVG rendering authority that users should review before installing.

Install only if you trust the Markdown files and SVG content you will convert, or run it in a restricted environment with no internal-network access and limited filesystem access. Be especially careful with third-party Markdown because image links can trigger outbound requests and local image paths can embed readable local images into the generated DOCX.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/md2word.py:153

Finding

Unrestricted External Image Downloads Enable SSRF and Resource Exhaustion

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/md2word.py:907

Finding

Markdown-Controlled Paths Can Read and Embed Arbitrary Local Images

Content

View full analysis

Remediation

View remediation

` elements 8. Record external local-file access in a clear audit log without exposing sensitive path details unnecessarily. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/svg2png.js:57

Finding

Untrusted Inline SVG Is Loaded in Chromium with the Browser Sandbox Disabled

Content

View full analysis

...，渲染为 PNG 嵌入；失败降级代码框显示源码） if line.startswith('' not in svg_lines[-1]: svg_lines.append(lines[i]) i += 1 svg_code = '\n'.join(svg_lines) ok = render_inline_svg( lambda img: insert_image_to_word(doc, img), svg_code, md_file_path, svg_counter[0]) ``` The Puppeteer fallback is invoked as a subprocess: ```python script_dir = os.path.dirname(os.path.abspath(__file__)) svg2png_js = os.path.join(script_dir, 'svg2png.js') if shutil.which('node') and os.path.exists(svg2png_js): try: dpi = int(96 * zoom) r = subprocess.run(['node', svg2png_js, svg_path, png_path, str(dpi)], capture_output=True, text=True, timeout=60) ``` The SVG is inserted directly into browser HTML, while Chromium sandboxing is explicitly disabled: ```javascript const svgContent = fs.readFileSync(inputPath, "utf8"); const html = ` html, body { margin: 0; padding: 0; background: transparent; } svg { display: block; } ${svgContent} `; let browser; try { browser = await puppeteer.launch({ headless: "new", args: [ "--no-sandbox", "--disable-setuid-sandbox", "--disable-dev-shm-usage", "--disable-gpu", "--no-first-run", "--no-zygote", ], executablePath: findChrome(), }); const page = await browser.newPage(); await page.setContent(html, { waitUntil: "domcontentloaded", timeout: 10000 }); ``` ### Technical Analysis ...[truncated 2351 chars]

Remediation

View remediation

` elements - Event-handler attributes - `foreignObject` - External URLs - Remote fonts, styles, images, and references - Potentially dangerous animation or navigation elements 4. Disable JavaScript on the Puppeteer page before loading content. 5. Intercept all browser requests and reject every network request not strictly required for rendering. 6. Apply a restrictive Content Security Policy such as blocking scripts, connections, frames, objects, and external media. 7. Render in an isolated container or worker with: - An unprivileged user - No internal network access - A read-only filesystem - A dedicated temporary directory - CPU, memory, process, and output-size limits 8. Keep Chromium and Puppeteer pinned to reviewed, supported security versions. 9. Prefer a hardened, non-browser SVG rasterizer after sanitization. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Installation Instructions Use Unpinned Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (49)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

声明的核心功能是“Markdown转Word文档”，即应当接收 Markdown 并生成排版后的 Word 文档。但该代码块的主功能完全不同：它读取 .docx 模板文件，抽取格式参数并导出 YAML 配置，服务于 md2word 配置生成流程。虽然这可能是 Markdown 转 Word 系统的辅助工具，但就该代码块本身而言，既不解析 Markdown，也不生成 Word 文档，因此与声明的主要用途存在明显不一致。未见敏感权限或恶意行为，但功能方向属于模板配置提取而非文档转换。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是文档处理技能：输入应为 Markdown，输出应为 Word，并强调中文排版规范与预设格式。代码中完全没有 Markdown 解析、Word 文件生成、文档模板、排版规则或中文格式处理逻辑。相反，代码仅处理 SVG 文件，启动 Puppeteer 打开包含 SVG 的 HTML 页面并截图导出为 PNG，且包含 DPI 控制和目录批量转换功能。这说明其主要目的与声明严重不符，属于明显的描述与行为不一致。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This change re-enables default network access to download remote images, which is risky for a Markdown-to-Word skill because untrusted input can now cause outbound requests. That behavior can expose internal network reachability, disclose environment/IP information to third parties, and violate least-privilege expectations for a formatting tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The changelog documents that the skill automatically downloads external URL images during Markdown conversion, which adds active network-fetch behavior beyond simple local document formatting. When processing untrusted Markdown, this can trigger SSRF-like requests, leak IP/network metadata, and cause the agent to contact attacker-controlled hosts without explicit user intent at the execution point.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The changelog entry introducing automatic remote image downloads does not itself present a direct warning alongside the behavior change, increasing the chance that operators miss the privacy and network implications. For a skill that may process third-party Markdown, insufficient inline warning contributes to unsafe use by hiding that untrusted content can trigger outbound requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file's natural-language content is fully Chinese, including headings and operational notes, with no indication that users may choose another language. Under the language/locale policy rule, forcing a specific language without opt-in is a policy concern unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes a skill that converts Markdown into professionally formatted Word documents with Chinese typography presets. DEC-004 states the implementation downloads HTTP/HTTPS images from external URLs via urllib.request, which introduces network access beyond local document conversion and formatting. While image handling is relevant to document conversion, external network retrieval is a distinct capability not declared in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly advertises automatic embedding of external URL images but does not warn users that conversion may trigger outbound network requests to third-party hosts. In document-processing workflows, this can leak sensitive document context, user IP/network metadata, or cause unintended access to attacker-controlled resources, so the missing disclosure is a real security weakness in user guidance.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill documentation declares significant capabilities—local script execution, external subprocess invocation, environment-variable reads, file read/write, and default-enabled network access to arbitrary URLs—but does not define an explicit tool scope such as permissions or allowed-tools. This creates a real least-privilege and review problem: an agent or user may invoke the skill without a machine-readable boundary, increasing the chance of unintended shell, filesystem, or network use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The preset is named and described exclusively as a Chinese legal-document format, with Chinese-specific font and formatting assumptions. Under the policy, forcing a specific language or locale without opt-in or an explicit documented regional/compliance justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This YAML preset is explicitly tailored to Chinese-language document output, including a Chinese-only name/description, Chinese quote conversion, and Chinese-specific fonts such as 微软雅黑 and 仿宋. Because the file does not offer any language choice or document a justified region-specific restriction, it creates a locale policy concern by implicitly forcing one language/formatting convention.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Lines L001-L003 describe the theme as specifically aligned to domestic Chinese academic formatting conventions, using Chinese typography requirements and presenting them as the default behavior. This can constitute a language/locale policy issue because it enforces a specific locale and document standard without an explicit opt-in or clearly stated region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file contains user-facing natural-language instructions exclusively in Chinese, and nowhere indicates that other languages are supported or that the language is a documented, justified locale constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire markdown file, including headings, instructions, and examples, is presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file’s title and descriptive content are entirely in Chinese, and there is no indication that the skill supports other languages or that Chinese is an explicitly user-selected option. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire reference is written only in Chinese, including all operational instructions and configuration explanations, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only audience. Under the policy rule for language/locale constraints, this appears to impose a specific language without user opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code file contains natural-language documentation and runtime messages exclusively in Chinese, with no indication that users can choose another language or locale. That can violate a language/locale policy when the skill is expected to operate in a broader environment without explicit opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/chart_handler.py (reported line 104)May include surrounding context.

python

cmd.extend(["-c", cfg])

        print(f"🔧 执行命令: {' '.join(cmd)}")
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)

        if result.returncode != 0:
            print(f"⚠️ mmdc 命令执行失败: {result.stderr}")

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is described as converting Markdown to professionally formatted Word documents, but this module executes a local external program (mmdc) via subprocess.run. Spawning subprocesses is a broader capability than ordinary document formatting logic and is not explicitly justified in the stated manifest purpose.

Content

No source excerpt is available for this finding.

Tainted flow: 'cmd' from os.environ.get (line 99, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 94% confidence

Finding

The executable path used in cmd can come directly from the MMDCCMD environment variable, allowing an attacker who controls the process environment to cause execution of an arbitrary program. In an agent or plugin environment where untrusted users may influence runtime configuration, this becomes code execution in the context of the host process.

Content

Scanner excerpt · scripts/chart_handler.py (reported line 104)May include surrounding context.

python

cmd.extend(["-c", cfg])

        print(f"🔧 执行命令: {' '.join(cmd)}")
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)

        if result.returncode != 0:
            print(f"⚠️ mmdc 命令执行失败: {result.stderr}")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains user-facing descriptions and messages entirely in Chinese, including module docstrings and CLI help text, which indicates a fixed language experience. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The command-line interface presents its description, argument help, and output messages only in Chinese. Because these are end-user visible strings and no language choice or locale justification is provided in the file, this violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language documentation and behavior descriptions exclusively in Chinese, including the module docstring and comments describing its purpose. Under the policy rule, forcing a specific language without opt-in or documenting a justified locale-specific scope is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The print statement emits a user-visible status message only in Chinese. Because the file does not offer language choice or explain that the tool is intentionally Chinese-only, this hardcoded locale creates a natural-language policy issue.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The function explicitly performs outbound HTTP(S) requests to fetch images referenced in Markdown and then embeds the returned content into the generated document. In a Markdown-to-Word converter this creates an SSRF/privacy boundary issue: opening attacker-supplied Markdown can trigger network access to arbitrary hosts, leak the user's IP and environment metadata, and pull untrusted content into the workflow without explicit consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.