MarkItDown

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:04 AM UTC
• Version: 1.0.4

Overview

This skill is a straightforward local document-conversion helper, with disclosed dependency and file/network access needs.

Before installing, understand that this skill will download Python packages from PyPI and process files you point it at. Use it on documents you intend to convert, and avoid remote URL conversion unless network fetching is acceptable in your environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party Package and Optional Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–16
Vulnerability Type: Uncontrolled third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

json

"install":
  [
    {
      "id": "venv",
      "kind": "exec",
      "command": "python3 -m venv .venv && .venv/bin/pip install 'markitdown[all]'",
      "label": "Create virtual environment and install markitdown with all dependencies from PyPI",
    },
  ],

Technical Analysis

The installation command resolves the latest available version of markitdown and all dependencies enabled by its all extra from PyPI. It does not use pinned versions, a reviewed lockfile, package hashes, or --require-hashes.

The virtual environment limits changes to the global Python environment, but it does not sandbox installed packages from the installing user's filesystem or network privileges. Package installation may also execute package build logic. Consequently, compromise of the named package or any transitive dependency could cause attacker-controlled code to run under the Agent or user account.

Installing the full all dependency set also exceeds minimum dependency scope when the user only needs selected conversion formats, unnecessarily increasing supply-chain exposure.

Attack Path

1. An attacker compromises an upstream markitdown release or one of its transitive dependencies.
2. Alternatively, an unsafe future dependency version is published to the configured package index.
3. The Skill installation runs pip install 'markitdown[all]' without version or hash constraints.
4. Pip resolves and downloads the attacker-controlled or compromised version.
5. Malicious build or runtime code executes with the privileges of the account installing or invoking the package.
6. The malicious dependency can access resources available to that account, including documents supplied for conversion, and may transmit or mo ...[truncated 881 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin markitdown to a specifically reviewed version rather than resolving the latest release.
2. Generate and commit a lockfile containing exact versions for all transitive dependencies.
3. Record approved package hashes and install with pip --require-hashes.
4. Replace the all extra with only the format-specific dependencies required for the declared task.
5. Use a trusted, controlled package index or internal artifact mirror with package provenance and integrity verification.
6. Perform installation and document conversion in a sandbox with restricted filesystem access, a minimal environment, and network access disabled by default.
7. Enable outbound network access only when the user explicitly requests conversion of a remote URL.
8. Regularly scan and review the locked dependency set before approving updates.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.