Security audit
Security checks for vulnerabilities and agentic risk
This document conversion skill is purpose-aligned, but it should be reviewed because normal workflows can run unpinned remote packages and load third-party scripts.
Review this skill before installing in environments that handle sensitive documents. It is not backed by artifact evidence of theft, deception, or destructive behavior, but users should prefer pinned or preinstalled converter versions, avoid live npx/uvx fetching for trusted workflows, use local Mermaid assets instead of CDN scripts for private decks, and confirm output paths to avoid accidental overwrites.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<div class="mermaid"> instead of a code block<!-- ❌ Does not render in Marp -->
```mermaid
sequenceDiagram
A->>B: Hello
The manifest description lists generic triggers such as "document export", "export pdf", and especially "document analysis", which are broad phrases likely to overlap with many unrelated user requests. The file does not provide exclusion conditions or negative examples to constrain when these triggers should or should not invoke this skill.
npx --yes md-to-pdf --version will resolve and run the latest matching package when not already installed, with no version pinning or integrity lock. That creates a supply-chain exposure where a malicious or compromised release could execute during routine capability checks, and it is especially risky because the command is presented as part of normal tool selection.
npx --yes md-to-pdf --version will resolve and run the latest matching package when not already installed, with no version pinning or integrity lock. That creates a supply-chain exposure where a malicious or compromised release could execute during routine capability checks, and it is especially risky because the command is presented as part of normal tool selection.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
|---|-------|-----|
| 1 | Detect "soffice not found" and silently switch to prince for an Official document | Run the install-ask above. Prince output on Official medium requires explicit user override |
| 2 | Assume LibreOffice from a prior session is still installed | Run `command -v soffice` at the start of every conversion. State the check result in the response |
| 3 | Install LibreOffice without asking (400MB download is user-visible impact) | AskUserQuestion first. Install only after approval |
| 4 | Report "conversion done" when the medium is Official but the output was produced by prince (with watermark) | Watermark verification: `pdftotext output.pdf - | grep -i "unregistered\|non-commercial\|prince"`. If matched on Official medium = conversion failure, retry via LibreOffice |
### 4. Execution
The example command uses -V lang=ko-KR, which forces a specific language/locale in generated output. Elsewhere the skill supports general document conversion across multiple formats, but this locale restriction is not presented as optional or limited to Korean-specific workflows.
uvx --from pyhwp --with six hwp5txt fetches and executes Python packages without any pinned versions. That exposes the workflow to package-repository compromise or unexpected upstream changes, and because this is a fallback path for handling user-supplied documents, it can still be triggered in realistic use.
The tool inventory repeats the same unpinned uvx execution pattern, reinforcing a documented practice of dynamically downloading and running Python packages. Repetition increases the chance the unsafe pattern is followed operationally, sustaining supply-chain and reproducibility risk.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
If the docx skill (Anthropic, native OOXML) is installed, prefer it. It produces much more polished Word output (styles, TOC, tables, page numbers, letterheads, images, tracked changes) than pandoc.
1. Check docx skill install: ls ~/.claude/skills/docx/SKILL.md (or "docx" in the available-skills list)
2. If installed → Skill("docx") delegation to generate/edit the .docx from md
3. Not installed + user wants high quality → suggest install: npx skills add anthropics/skills@docx -g -y
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
If the docx skill (Anthropic, native OOXML) is installed, prefer it. It produces much more polished Word output (styles, TOC, tables, page numbers, letterheads, images, tracked changes) than pandoc.
1. Check docx skill install: ls ~/.claude/skills/docx/SKILL.md (or "docx" in the available-skills list)
2. If installed → Skill("docx") delegation to generate/edit the .docx from md
3. Not installed + user wants high quality → suggest install: npx skills add anthropics/skills@docx -g -y
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
If the docx skill (Anthropic, native OOXML) is installed, prefer it. It produces much more polished Word output (styles, TOC, tables, page numbers, letterheads, images, tracked changes) than pandoc.
1. Check docx skill install: ls ~/.claude/skills/docx/SKILL.md (or "docx" in the available-skills list)
2. If installed → Skill("docx") delegation to generate/edit the .docx from md
3. Not installed + user wants high quality → suggest install: npx skills add anthropics/skills@docx -g -y
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
If the docx skill (Anthropic, native OOXML) is installed, prefer it. It produces much more polished Word output (styles, TOC, tables, page numbers, letterheads, images, tracked changes) than pandoc.
1. Check docx skill install: ls ~/.claude/skills/docx/SKILL.md (or "docx" in the available-skills list)
2. If installed → Skill("docx") delegation to generate/edit the .docx from md
3. Not installed + user wants high quality → suggest install: npx skills add anthropics/skills@docx -g -y
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
If the docx skill (Anthropic, native OOXML) is installed, prefer it. It produces much more polished Word output (styles, TOC, tables, page numbers, letterheads, images, tracked changes) than pandoc.
1. Check docx skill install: ls ~/.claude/skills/docx/SKILL.md (or "docx" in the available-skills list)
2. If installed → Skill("docx") delegation to generate/edit the .docx from md
3. Not installed + user wants high quality → suggest install: npx skills add anthropics/skills@docx -g -y
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
If the docx skill (Anthropic, native OOXML) is installed, prefer it. It produces much more polished Word output (styles, TOC, tables, page numbers, letterheads, images, tracked changes) than pandoc.
1. Check docx skill install: ls ~/.claude/skills/docx/SKILL.md (or "docx" in the available-skills list)
2. If installed → Skill("docx") delegation to generate/edit the .docx from md
3. Not installed + user wants high quality → suggest install: npx skills add anthropics/skills@docx -g -y
The skill instructs users to install a dependency via npx skills add anthropics/skills@docx -g -y without pinning an immutable version. That can result in different code being fetched over time, creating a supply-chain risk if the package or tag is changed or compromised.
The auto-conversion section tells the agent to execute conversion commands directly and report output paths, but it does not require confirmation before creating or overwriting files. In practice this can clobber existing .docx/.pdf outputs or write into unintended locations if paths are reused or user-supplied.
The file opens by claiming Marp converts .marp.md to HTML, PDF, and PPTX, yet later states Mermaid works only in HTML output and that PDF requires an HTML-first manual browser print flow. This creates a semantic mismatch between the apparent conversion capability and the actual behavior for a prominently documented Marp feature.
The skill tells the agent to execute conversion commands directly and write output files without any confirmation, safety notice, or trust boundary checks on the provided file path. In an agent environment, this increases the risk of unintended command execution workflows, processing of untrusted files, or overwriting files in sensitive locations if the surrounding system does not constrain inputs and execution.
The skill instructs use of npx --yes @marp-team/marp-cli without pinning a version, which causes execution of whatever package version is current at runtime. In an agent context that auto-executes commands, this creates a supply-chain risk: a compromised upstream release or unexpected breaking change could lead to arbitrary code execution or unsafe behavior on the host.
This conversion command again relies on npx --yes @marp-team/marp-cli without version pinning, so the tool is downloaded/executed dynamically from the registry. Because the skill explicitly tells the agent to execute commands directly, the unpinned dependency meaningfully increases the chance of supply-chain compromise or unreviewed behavior changes reaching production workflows.
The Mermaid workflow introduces a remote CDN dependency by importing mermaid.js from jsDelivr, even though the skill is primarily framed as local document conversion. Rendering generated HTML that loads third-party JavaScript can leak metadata, break offline guarantees, and expose users to integrity and script-supply-chain risks if the CDN content changes or is compromised.
The instructions recommend loading a remote CDN script into generated HTML without prominently warning that this performs external network access and executes third-party JavaScript. In a conversion skill, that changes the trust model of the output and can surprise users who expect static, local artifacts.
The script advertises fallback execution via npx --yes @marp-team/marp-cli, which pulls and runs the latest package version at time of use instead of a pinned, reviewed release. That creates a supply-chain risk: a compromised upstream package, malicious dependency update, or breaking release could execute arbitrary code on the host when users follow this guidance.
The install guidance recommends npx --yes @marp-team/marp-cli without a fixed version, causing the tool to resolve and execute whatever current package version is published. In a dependency-check helper, this is especially relevant because users are likely to copy-paste the command, turning a documentation/runtime convenience into an unreviewed remote-code execution path.
The template specifies 'Pretendard' and 'Noto Sans KR', which imposes a Korean-oriented font stack by default. There is no explanation that this is region-specific or any option for users to choose a different locale-appropriate font configuration.
No suspicious patterns detected.