Security audit

Md Linter

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Markdown linter/formatter with expected file edits and optional link-checking behavior, plus a CI verifier that should only be run on trusted code.

Reasonable to install for normal Markdown linting. Use --write or --insert only on files you are willing to modify, use --check-external only when outbound requests to linked sites are acceptable, and avoid running the bundled CI verifier on untrusted repositories outside a sandbox.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: def has_self_test(fp): r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30) return r.returncode == 0 and "PASS" in r.stdout
Confidence: 70% confidence
Finding: r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: # 7 deploy-ready ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py") if os.path.isfile(ci) and os.path.isfile(skill): r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True) all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)") else: all_ok &= axis(True, "deploy-ready (skipped)")
Confidence: 70% confidence
Finding: r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: all_ok &= axis(False, "frontmatter (no SKILL.md)") all_ok &= axis(False, "docs (no SKILL.md)") # 3 compiles comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp], capture_output=True).returncode == 0 for fp in files) all_ok &= axis(comp_ok, "compiles (py_compile all .py)") # 4 self-test (any of 3 valid forms)
Confidence: 70% confidence
Finding: comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp], capture_output=True).returncode == 0 for fp in files)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: tests = [os.path.join(folder, f) for f in os.listdir(folder) if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")] if tests: st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True, timeout=30).returncode == 0 for t in tests) st_note = f"{len(tests)} test_*.py" elif re.search(r"(?im)^test\s*:", skill_txt):
Confidence: 70% confidence
Finding: st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True, timeout=30).returncode == 0 for t in tests)

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The `links --check-external` path performs HTTP HEAD requests to URLs found in the Markdown file, which transmits network metadata to third-party servers. Although this behavior is implied by the flag name, the code does not provide any runtime disclosure or caution that enabling the option causes outbound network access.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The `format --write` mode writes modified content back to the target file, which is a file-changing operation. While the flag name suggests writing, there is no confirmation prompt or cautionary description warning users that the original file will be overwritten.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: When `toc --insert` is used, the command rewrites the Markdown file after removing any existing TOC and inserting a new one. The code prints success after writing, but it does not warn beforehand that the operation will modify the file contents.

Unvalidated Output Injection

High

Category: Output Handling
Content: def has_self_test(fp): r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30) return r.returncode == 0 and "PASS" in r.stdout
Confidence: 95% confidence
Finding: subprocess.run([sys.executable, fp, "self-test"], capture_output

Unvalidated Output Injection

High

Category: Output Handling
Content: all_ok &= axis(False, "frontmatter (no SKILL.md)") all_ok &= axis(False, "docs (no SKILL.md)") # 3 compiles comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp], capture_output=True).returncode == 0 for fp in files) all_ok &= axis(comp_ok, "compiles (py_compile all .py)") # 4 self-test (any of 3 valid forms)
Confidence: 95% confidence
Finding: subprocess.run([sys.executable, "-m", "py_compile", fp], capture_output

Unvalidated Output Injection

High

Category: Output Handling
Content: tests = [os.path.join(folder, f) for f in os.listdir(folder) if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")] if tests: st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True, timeout=30).returncode == 0 for t in tests) st_note = f"{len(tests)} test_*.py" elif re.search(r"(?im)^test\s*:", skill_txt):
Confidence: 95% confidence
Finding: subprocess.run([sys.executable, t], capture_output

Unvalidated Output Injection

High

Category: Output Handling
Content: # 7 deploy-ready ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py") if os.path.isfile(ci) and os.path.isfile(skill): r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True) all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)") else: all_ok &= axis(True, "deploy-ready (skipped)")
Confidence: 95% confidence
Finding: subprocess.run([sys.executable, ci], cwd=folder, capture_output

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.