T09 · Insecure Skill Coding Practices
Error
- Location
scripts/markdown2doc.js:88- Finding
Symlink Bypass Allows Upload of Files Outside the Markdown Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
Markdown2Doc
Security checks for vulnerabilities and agentic risk
Overview
This skill performs remote Markdown conversion, but it needs Review because its file handling could expose local files or overwrite files beyond the intended output location.
Install only if you are comfortable sending the Markdown file and referenced local images to lab.hjcloud.com. Do not use it on confidential documents or untrusted Markdown directories, especially ones that may contain symlinks. Treat the output write behavior as risky until the script ignores server-supplied filenames or strictly validates the final output path.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/markdown2doc.js:365- Finding
Untrusted Response Filename Allows Path Traversal and Arbitrary File Overwrite
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The code packages and uploads the full Markdown source plus referenced local images to an external endpoint. Because Markdown files often contain proprietary text, credentials, internal URLs, diagrams, or screenshots, this is direct exfiltration of local content to a third party and is especially dangerous given the skill does not clearly present this behavior as data export.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill presents itself as a lightweight local conversion utility with 'no external dependencies,' but its workflow and privacy section disclose that it uploads markdown content and locally referenced images to a remote cloud service for processing. This mismatch is dangerous because users may provide sensitive local documents under the assumption that conversion is local-only, causing unintended exfiltration of proprietary or confidential data.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/markdown2doc.js convert <file_path> pdf # Output: same_name.pdf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/markdown2doc.js convert <file_path> pdf # Output: same_name.pdf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/markdown2doc.js convert <file_path> pdf # Output: same_name.pdf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/markdown2doc.js convert <file_path> pdf # Output: same_name.pdf
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code hardcodes a remote HTTPS conversion service despite the skill being described as a lightweight local utility with no external dependencies. This creates a deceptive data-flow where user Markdown and related content may leave the host unexpectedly, which is a significant security and trust issue even if transport is encrypted.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The conversion path is implemented around remote API endpoints rather than a local renderer, contradicting the skill's stated purpose as a local document utility. In practice this means potentially sensitive documents are sent off-box to a third-party service, expanding the attack surface to data leakage, retention, and service compromise risks.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The inline documentation states a restrictive file-access intent, yet the actual restriction is only applied to embedded image paths relative to the Markdown file directory. The primary Markdown input itself is accepted from any filesystem path, so the comment overstates the scope of the safety control.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill transmits Markdown and local images to a remote service without a conspicuous warning or consent mechanism. Even if remote conversion is intended, the lack of transparent disclosure undermines informed user consent and materially increases the risk of accidental exposure of sensitive local data.
- Content
Static analysis
No suspicious patterns detected.