Cn Markdown To Html

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:09 AM UTC
• Version: 1.1.1

Overview

This is a simple local Markdown-to-HTML helper with quality and generated-HTML safety risks, but no evidence of hidden agent control, credential access, persistence, exfiltration, or destructive behavior.

Install only if you want a basic local converter and are comfortable reviewing or fixing the script first. Do not use it to process untrusted Markdown for a website or trusted browser origin unless HTML escaping, URL validation, and sanitization are added.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/md_to_html.py:6

Finding

Unescaped Markdown Enables Script Injection in Generated HTML

Content

View full analysis

\1", html, flags=re.MULTILINE) html = re.sub(r"^## (.+)$", r"

\1

", html, flags=re.MULTILINE) html = re.sub(r"^# (.+)$", r"

\1

", html, flags=re.MULTILINE) # Bold/italic html = re.sub(r"\*\*(.+?)\*\*", r"\1", html) html = re.sub(r"\*(.+?)\*", r"\1", html) # Code html = re.sub(r"`(.+?)`", r"\1", html) # Links html = re.sub(r"\[(.+?)\]\((.+?)\)", r'\1', html) # Paragraphs paragraphs = [p.strip() for p in html.split(" ") if p.strip()] html = "\n".join(f"

{p}

" if not p.startswith("<") else p for p in paragraphs) return f""" Converted {html}""" ``` ### Technical Analysis The converter initially assigns the complete, untrusted Markdown input to `html` and then performs regular-expression substitutions without first HTML-encoding input text. Any HTML elements already present in the Markdown therefore remain active in the generated document. The paragraph construction further preserves content beginning with `<` instead of wrapping or sanitizing it: ```python html = "\n".join(f"

{p}

" if not p.startswith("<") else p for p in paragraphs) ``` Consequently, payloads such as the following can become executable browser content: ```html ``` ```html ``` The link conversion also inserts the attacker-controlled destination directly into an `href` attribute without attribute escaping or URL-scheme validation: ```python html = re.sub(r"\[(.+?)\]\((.+?)\)", r'

Remediation

View remediation

` elements. - Test event attributes such as `onerror`. - Test attribute-breaking quotation marks. - Test `javascript:` and dangerous `data:` URLs. - Verify that ordinary Markdown still produces correctly encoded HTML. ]]>

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The overall purpose mostly matches: this is a standard-library Python Markdown-to-HTML converter. However, there are two notable discrepancies. First, the description claims support for 'code blocks,' but the implementation only converts inline backtick code (...) and has no handling for fenced or block code sections. Second, the code requires reading a file via the --file argument, which is a resource access capability not reflected in the declared permissions section. These are material enough to count as a mismatch, though the primary purpose remains aligned.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file is primarily written in English, but the closing promotional section switches to Chinese-only text. This creates a language/locale policy concern because the skill presents content in a specific language without user opt-in or any explanation that the skill is intended for a Chinese-speaking audience.

Content

No source excerpt is available for this finding.