Chrome Markdown to PDF

• Outcome: Review
• Latest audit: May 29, 2026, 9:34 PM
• Version:
  1.0.0

Overview

This skill is a Markdown-to-PDF converter, but it can render active HTML or JavaScript from Markdown in Chrome without warning or isolation.

Install only if you plan to convert Markdown files you trust. Avoid using it on Markdown from unknown sources unless the maintainer adds HTML escaping or sanitization and runs Chrome with stronger isolation such as a temporary profile, disabled JavaScript, and restricted network behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation phrases include very generic terms such as '转PDF', '导出PDF', and '生成PDF', which can match many unrelated requests. Over-broad triggering can cause the wrong skill to activate and run file-reading or shell-based conversion logic in contexts where the user did not specifically request this tool.

VirusTotal

66/66 vendors flagged this skill as clean.