Security audit

MD2DOC 文档转换器

Security checks for vulnerabilities and agentic risk

Overview

This is a normal Markdown document converter, but it can automatically download images referenced by documents, so untrusted Markdown may cause network requests from the user’s environment.

Install only if you are comfortable running a local Python document converter. Review or remove remote image URLs before converting third-party Markdown, and consider running it in a virtual environment or sandbox. Treat generated HTML from untrusted Markdown as untrusted content when opening it in a browser.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documentation and example usage indicate capabilities to read user-supplied files, write output documents, access the network to download images, and invoke shell/subprocess execution, yet no permissions are declared. That creates a transparency and policy-enforcement gap: users or the host agent may invoke broader powers than expected, especially because the skill processes arbitrary paths and remote resources.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The chart generator writes PNG files to disk using tempfile.mktemp, which is an unsafe temporary-file pattern and can introduce race-condition or symlink attacks in shared environments. Because this disk-write behavior is also undeclared in the skill description, operators may not expect persistent filesystem side effects when processing untrusted Markdown/table content.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The converter will fetch arbitrary remote image URLs embedded in Markdown, which can trigger server-side request forgery behavior, unexpected network egress, internal resource probing, and privacy leaks about the host environment. In this skill context, users expect document conversion, not silent outbound requests derived from document content, which makes the behavior more dangerous.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README advertises support for network images and later notes that image handling will automatically download remote images, but it does not clearly warn users that converting an untrusted Markdown file may trigger outbound network requests. In a document-conversion skill, this can cause unexpected data egress, privacy issues, SSRF-like access to internal resources, or accidental fetching of attacker-controlled content during conversion.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill states that network images are automatically downloaded and embedded, but the documentation does not clearly warn users that external network requests will be made. This can leak IP/addressing metadata, contact attacker-controlled servers embedded in Markdown, and potentially expose the agent environment to SSRF-like access if internal URLs are allowed.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script downloads remote images referenced by Markdown and writes them to local temporary storage without explicit consent or warning, creating unanticipated network activity and local artifact creation. This can leak environment metadata, expose internal services through fetched URLs, and consume disk or memory with attacker-chosen content.

Static analysis

No suspicious patterns detected.