Security audit

MD2DOC 文档转换器

Security checks for vulnerabilities and agentic risk

Overview

This is a real Markdown converter, but it needs Review because it automatically fetches remote images and has unsafe temporary-file cleanup that can delete existing data.

Install only if you trust the Markdown inputs and the environment where conversion runs. Avoid converting untrusted Markdown with remote image links, do not point output at directories where .temp_images may contain important files, and prefer a sandboxed or offline environment until remote fetching and temporary-file handling are fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/convert.py:37
Finding: Unrestricted Remote Image Retrieval Enables Server-Side Request Forgery and Resource Exhaustion
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/convert.py:232
Finding: Fixed Temporary Directory Cleanup Can Delete Pre-Existing User Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ai_analyzer.py:301
Finding: Predictable Chart Temporary Files Permit Local Race and Symlink Attacks
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/convert.py:457
Finding: Generated HTML Preserves Active Markup from Untrusted Markdown
Content: View full analysis
文档 /* Static document styles omitted here only for readability. */ {html_content} ''' ``` The security-relevant complete output operation is: ```python with open(output_file, 'w', encoding='utf-8') as f: f.write(html_template) ``` ### Technical Analysis Python Markdown permits raw HTML by default. The conversion result is inserted directly into a complete HTML document without sanitization. No restrictive Content Security Policy is added. As a result, attacker-controlled Markdown can preserve active elements and event handlers in the exported document. Depending on the browser and how the file is served or opened, this may include scripts, resource-loading elements, deceptive forms, event-handler attributes, or navigation to attacker-controlled content. This is particularly significant when one user supplies Markdown and another user trusts and opens the generated HTML because it was produced by the converter. ### Attack Path 1. An attacker supplies Markdown containing active HTML, for example: ```html ``` 2. The converter passes the input to `markdown.markdown()` without disabling raw HTML. 3. The resulting markup is interpolated into `html_template`. 4. The generated file is delivered to or opened by a victim. 5. The browser interprets the active markup in the security cont ...[truncated 718 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package.json:11
Finding: Unpinned and Incorrectly Declared Third-Party Dependencies Create Supply-Chain Risk
Content: View full analysis
=3.8", "python-docx": ">=0.8.11", "requests": ">=2.25.0", "markdown": ">=3.3.0", "beautifulsoup4": ">=4.9.0", "Pillow": ">=8.0.0" } ``` The documented installation command is: ```bash pip install python-docx requests markdown beautifulsoup4 Pillow ``` ### Technical Analysis The project does not provide a Python dependency lock file, exact version constraints, or package hashes. Installation therefore resolves mutable package versions at execution time, making builds non-reproducible and allowing future dependency changes to alter the code executed by the Skill. Additionally, Python and PyPI packages are listed under npm's `dependencies` field. If a user runs `npm install`, npm interprets these names as packages from the npm registry rather than as Python runtime requirements. Packages with identical names in another ecosystem are not guaranteed to represent the intended software. There is no evidence in the reviewed project that the named packages are intentionally malicious. The vulnerability is the unsafe and ambiguous dependency acquisition process. ### Attack Path 1. A user installs the project according to its metadata or documentation. 2. `pip` resolves the latest versions satisfying the broad or absent constraints, or npm resolves same-named packages from the npm registry. 3. A future compromised release, unintended package, dependency-confusion event, or incompatible update is selected. 4. Package installation or import executes code under the user's privileges. 5. The effective dependency payload differs from the version that was originally reviewed. ### Impact Assessment A compromised or ...[truncated 437 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a simple document converter, but the described behavior includes remote downloads and execution of local conversion components like Word COM or LibreOffice. This is dangerous because hidden network access and local application invocation materially expand the attack surface and can cause users or agents to run riskier operations than the declared purpose suggests.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a simple document converter, but the described behavior includes remote downloads and execution of local conversion components like Word COM or LibreOffice. This is dangerous because hidden network access and local application invocation materially expand the attack surface and can cause users or agents to run riskier operations than the declared purpose suggests.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a simple document converter, but the described behavior includes remote downloads and execution of local conversion components like Word COM or LibreOffice. This is dangerous because hidden network access and local application invocation materially expand the attack surface and can cause users or agents to run riskier operations than the declared purpose suggests.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: manifest 将技能描述为 Markdown 文档转换器，但代码为生成 PDF 启动 Microsoft Word COM 自动化以及 LibreOffice headless 子进程。对外部应用和子进程的控制是高权限执行能力，不是 manifest 中明确声明的范围，即使其服务于 PDF 导出，也应被显式披露。
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script sends or processes full document content through AI analysis functionality without clearly informing the user that sensitive file contents may leave the local environment. In a document-processing skill, this is especially dangerous because users may convert confidential reports, contracts, or internal notes and reasonably expect local-only handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises support for network images but does not warn that document conversion may initiate outbound requests to third-party hosts. This can leak IP address, timing, user-agent/environment details, and may cause the tool to fetch untrusted remote content during a local conversion workflow where users may reasonably expect offline processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The dependency section states that image processing automatically downloads network images and embeds them, but it provides no warning about external network access, privacy leakage, or the risk of retrieving attacker-controlled content. In a conversion skill, users may supply untrusted Markdown, so automatic remote fetches can enable tracking and unexpected network activity during routine document generation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation describes capabilities that imply file reads/writes, network access, and shell execution, but it declares no explicit tool scope or permissions boundary. This is dangerous because an agent may invoke the skill with broader privileges than users expect, increasing the chance of unintended command execution, file modification, or network access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description is broad enough that ordinary requests about documents or conversion could invoke the skill unexpectedly. In this context, accidental invocation matters because the skill may read local files, write outputs, invoke subprocesses, and potentially access the network, so overbroad triggering can lead to unintended sensitive operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill states that network images are automatically downloaded and embedded, but it does not clearly warn users that conversion may trigger outbound requests. This is dangerous because embedded remote image URLs can leak metadata, contact untrusted hosts, or fetch malicious content unexpectedly during what appears to be a local document conversion workflow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a document conversion skill that applies templates and exports Markdown to Word/PDF/HTML. This file instead implements semantic analysis features such as document-type detection, topic extraction, image suggestion prompts, and table-data extraction, which are not described as part of the converter’s behavior and materially expand the skill’s scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This is a natural-language policy issue because the file presents its user-facing description entirely in Chinese and does not indicate that other languages are supported. The stated policy requires flagging language constraints when they are forced without user opt-in or clear justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest promises Markdown conversion into styled Word/PDF/HTML documents, but this class creates new chart PNG files from extracted table data. Generating standalone visual assets is a distinct behavior from format conversion and is not disclosed in the stated skill purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is presented as a Markdown converter, but it also imports and exposes AI document analysis and chart generation capabilities. That mismatch increases the chance that sensitive document content is processed in ways users did not expect, especially if the analyzer uses external services or generates derivative artifacts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The converter silently downloads remote images referenced in Markdown, despite the skill description not disclosing network access. This can leak the user's IP and environment to third parties, fetch untrusted content, and create local files unexpectedly during what appears to be an offline conversion task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script fetches remote images and writes them to disk without an explicit warning or consent flow. This creates privacy and trust issues, and in a document-conversion context it can surprise users with external network traffic and persistence of untrusted content on the local system.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Allowing Markdown content to trigger remote image retrieval extends the skill beyond simple local format conversion into network-capable content fetching. In this context, that is more dangerous because untrusted Markdown can cause outbound requests and local file writes during routine document processing.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/convert.py (reported line 613)May include surrounding context.
python
if soffice: output_dir = os.path.dirname(pdf_file) result = subprocess.run([ soffice, "--headless", "--convert-to", "pdf", "--outdir", output_dir, docx_file ], capture_output=True, timeout=60)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language strings in the module docstrings, argument descriptions, status messages, and errors are consistently Chinese-only. This imposes a specific language on users without any visible opt-in or alternative locale support, matching the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/md2doc.py (reported line 55)May include surrounding context.
python
# 运行转换 try: result = subprocess.run(cmd, capture_output=True) # 处理编码 try: stderr_text = result.stderr.decode('utf-8') if result.stderr else ""

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: L008 说明该技能会将 Markdown 转换为 Word、PDF 和 HTML 文档，这意味着会在用户系统上生成新文件。文档虽说明了结果文件位置，但缺少显式的用户提醒，说明会创建输出文件并可能覆盖或占用目标目录。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language description is written only in Chinese, which can impose a specific language on users without offering a language choice or explaining a locale-specific scope. Under the policy, language constraints should be optional or clearly justified when they limit accessibility.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: markdown has 1 known advisory(ies) (GHSA-wx77-rp39-c6vg (Regular Expression Denial of Service in markdown)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: The manifest specifies markdown with a broad lower-bound version constraint rather than pinning or constraining to a known-safe release, so builds may resolve to a version affected by a known ReDoS advisory. In a Markdown-to-document conversion skill that processes user-supplied content, a vulnerable parser could allow crafted Markdown input to consume excessive CPU and cause denial of service.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: beautifulsoup4 has 1 known advisory(ies) (MAL-2025-3615 (Malicious code in beautifulsoup4 (npm))), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The HTML template forces lang="zh-CN" for all generated documents. This is a natural-language locale policy concern because the file does not provide a user opt-in or configurable language setting, and the tool appears to be a general Markdown converter rather than a clearly region-specific utility.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.