Security audit

Markdown to HTML Converter

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a Markdown conversion guide, but it includes broad setup, persistent config, and network-exposed static-site server guidance that users should review before use.

Install only if you want a broad Markdown/static-site conversion reference, not just a narrow renderer. Before following commands, prefer project-local pinned dependencies, avoid sudo/global installs unless you chose them, do not bind dev servers to 0.0.0.0 unless remote access is intentional, and sanitize HTML generated from untrusted Markdown.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:313
Finding: Mutable and Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
` - `go install github.com/gomarkdown/mdtohtml@` - `gem install jekyll -v ` - Avoid `@latest` in repeatable workflows. - Prefer project-local npm installation over global installation. - Commit ecosystem lockfiles such as `package-lock.json`, `Gemfile.lock`, or an appropriate Go module file. - Verify published checksums, signatures, provenance attestations, or package integrity metadata where supported. - Run dependency installation in a restricted container or unprivileged build environment. - Review updates before changing pinned versions and use automated vulnerability scanning for lockfiles. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:773
Finding: Hugo Development Server Exposed on All Network Interfaces
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:816
Finding: Overly Permissive Hugo Command and HTTP Security Policy
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (25)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/basic-markdown.md (reported line 31)May include surrounding context.
md
| Italic | `* *` or `_ _` | <kbd>Command</kbd>+<kbd>I</kbd> (Mac) or <kbd>Ctrl</kbd>+<kbd>I</kbd> (Windows/Linux) | `_This text is italicized_` | *This text is italicized* | | | Strikethrough | `~~ ~~` or `~ ~` | None | `~~This was mistaken text~~` | ~~This was mistaken text~~ | | | Bold and nested italic | `** **` and `_ _` | None | `**This text is _extremely_ important**` | **This text is *extremely* important** | | | All bold and italic | `*** ***` | None | `***All this text is important***` | ***All this text is important*** |  | | Subscript | ` ` | None | `This is a subscript text` | This is a subscript text | | | Superscript | ` ` | None | `This is a superscript text` | This is a superscript text | | | Underline | `<ins> </ins>` | None | `This is an <ins>underlined</ins> text` | This is an <ins>underlined</ins> text | |

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/code-blocks.md (reported line 38)May include surrounding context.
md
## Syntax highlighting  You can add an optional language identifier to enable syntax highlighting in your fenced code block.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger description is broad enough to match general work with Markdown files and templating systems, not just explicit Markdown-to-HTML conversion tasks. Over-broad activation increases the chance that the agent uses this skill in unrelated contexts, pulling in riskier behaviors and recommendations than the user asked for.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The usage criteria include generic static-site and template-system scenarios without clear exclusion rules, which makes misactivation likely. In an agent setting, ambiguous routing is dangerous because it can introduce extra tools, broader system changes, or network-related steps into otherwise simple content-conversion tasks.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 78% confidence
Finding: The instruction to create ~/.marked.json introduces persistent configuration changes to the user environment. In an agent context, persistence is risky because settings survive the immediate task, may affect future conversions unexpectedly, and can modify behavior outside the user’s current request.
Content: Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.
Using Config Files

Create ~/.marked.json for persistent options:

json
{

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill’s stated purpose is Markdown-to-HTML conversion, but these sections expand into broader document conversion and static-site workflows such as Jekyll and Pandoc multi-format usage. That scope creep can cause the agent to perform actions beyond user intent, increasing the chance of unnecessary file generation, tool invocation, or environment changes in contexts where only a simple conversion was requested.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section includes local server operations and network-facing bind options that are not necessary for Markdown-to-HTML conversion. If auto-selected, the skill could prompt or enable running a web server, including binding to 0.0.0.0, which expands exposure from offline file conversion to accessible network services.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/basic-markdown.md (reported line 29)May include surrounding context.
md
| ---------------------- | ------------------- | ------------------------------------------------------------------------------------- | ---------------------------------------- | -------------------------------------- | ------------------------------------------------- | | Bold | `** **` or `__ __` | <kbd>Command</kbd>+<kbd>B</kbd> (Mac) or <kbd>Ctrl</kbd>+<kbd>B</kbd> (Windows/Linux) | `**This is bold text**` | **This is bold text** | | | Italic | `* *` or `_ _` | <kbd>Command</kbd>+<kbd>I</kbd> (Mac) or <kbd>Ctrl</kbd>+<kbd>I</kbd> (Windows/Linux) | `_This text is italicized_` | *This text is italicized* | | | Strikethrough | `~~ ~~` or `~ ~` | None | `~~This was mistaken text~~` | ~~This was mistaken text~~ | | | Bold and nested italic | `** **` and `_ _` | None | `**This text is _extremely_ important**` | **This text is *extremely* important** | | | All bold and italic | `*** ***` | None | `***All this text is important***` | ***All this text is important*** |  | | Subscript | ` ` | None | `This is a subscript text` | This is a subscript text | |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/basic-markdown.md (reported line 30)May include surrounding context.
md
| ---------------------- | ------------------- | ------------------------------------------------------------------------------------- | ---------------------------------------- | -------------------------------------- | ------------------------------------------------- | | Bold | `** **` or `__ __` | <kbd>Command</kbd>+<kbd>B</kbd> (Mac) or <kbd>Ctrl</kbd>+<kbd>B</kbd> (Windows/Linux) | `**This is bold text**` | **This is bold text** | | | Italic | `* *` or `_ _` | <kbd>Command</kbd>+<kbd>I</kbd> (Mac) or <kbd>Ctrl</kbd>+<kbd>I</kbd> (Windows/Linux) | `_This text is italicized_` | *This text is italicized* | | | Strikethrough | `~~ ~~` or `~ ~` | None | `~~This was mistaken text~~` | ~~This was mistaken text~~ | | | Bold and nested italic | `** **` and `_ _` | None | `**This text is _extremely_ important**` | **This text is *extremely* important** | | | All bold and italic | `*** ***` | None | `***All this text is important***` | ***All this text is important*** |  | | Subscript | ` ` | None | `This is a subscript text` | This is a subscript text | |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/basic-markdown.md (reported line 31)May include surrounding context.
md
| ---------------------- | ------------------- | ------------------------------------------------------------------------------------- | ---------------------------------------- | -------------------------------------- | ------------------------------------------------- | | Bold | `** **` or `__ __` | <kbd>Command</kbd>+<kbd>B</kbd> (Mac) or <kbd>Ctrl</kbd>+<kbd>B</kbd> (Windows/Linux) | `**This is bold text**` | **This is bold text** | | | Italic | `* *` or `_ _` | <kbd>Command</kbd>+<kbd>I</kbd> (Mac) or <kbd>Ctrl</kbd>+<kbd>I</kbd> (Windows/Linux) | `_This text is italicized_` | *This text is italicized* | | | Strikethrough | `~~ ~~` or `~ ~` | None | `~~This was mistaken text~~` | ~~This was mistaken text~~ | | | Bold and nested italic | `** **` and `_ _` | None | `**This text is _extremely_ important**` | **This text is *extremely* important** | | | All bold and italic | `*** ***` | None | `***All this text is important***` | ***All this text is important*** |  | | Subscript | ` ` | None | `This is a subscript text` | This is a subscript text | |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/basic-markdown.md (reported line 32)May include surrounding context.
md
| ---------------------- | ------------------- | ------------------------------------------------------------------------------------- | ---------------------------------------- | -------------------------------------- | ------------------------------------------------- | | Bold | `** **` or `__ __` | <kbd>Command</kbd>+<kbd>B</kbd> (Mac) or <kbd>Ctrl</kbd>+<kbd>B</kbd> (Windows/Linux) | `**This is bold text**` | **This is bold text** | | | Italic | `* *` or `_ _` | <kbd>Command</kbd>+<kbd>I</kbd> (Mac) or <kbd>Ctrl</kbd>+<kbd>I</kbd> (Windows/Linux) | `_This text is italicized_` | *This text is italicized* | | | Strikethrough | `~~ ~~` or `~ ~` | None | `~~This was mistaken text~~` | ~~This was mistaken text~~ | | | Bold and nested italic | `** **` and `_ _` | None | `**This text is _extremely_ important**` | **This text is *extremely* important** | | | All bold and italic | `*** ***` | None | `***All this text is important***` | ***All this text is important*** |  | | Subscript | ` ` | None | `This is a subscript text` | This is a subscript text | |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/basic-markdown.md (reported line 33)May include surrounding context.
md
| ---------------------- | ------------------- | ------------------------------------------------------------------------------------- | ---------------------------------------- | -------------------------------------- | ------------------------------------------------- | | Bold | `** **` or `__ __` | <kbd>Command</kbd>+<kbd>B</kbd> (Mac) or <kbd>Ctrl</kbd>+<kbd>B</kbd> (Windows/Linux) | `**This is bold text**` | **This is bold text** | | | Italic | `* *` or `_ _` | <kbd>Command</kbd>+<kbd>I</kbd> (Mac) or <kbd>Ctrl</kbd>+<kbd>I</kbd> (Windows/Linux) | `_This text is italicized_` | *This text is italicized* | | | Strikethrough | `~~ ~~` or `~ ~` | None | `~~This was mistaken text~~` | ~~This was mistaken text~~ | | | Bold and nested italic | `** **` and `_ _` | None | `**This text is _extremely_ important**` | **This text is *extremely* important** | | | All bold and italic | `*** ***` | None | `***All this text is important***` | ***All this text is important*** |  | | Subscript | ` ` | None | `This is a subscript text` | This is a subscript text | |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/basic-markdown.md (reported line 34)May include surrounding context.
md
| ---------------------- | ------------------- | ------------------------------------------------------------------------------------- | ---------------------------------------- | -------------------------------------- | ------------------------------------------------- | | Bold | `** **` or `__ __` | <kbd>Command</kbd>+<kbd>B</kbd> (Mac) or <kbd>Ctrl</kbd>+<kbd>B</kbd> (Windows/Linux) | `**This is bold text**` | **This is bold text** | | | Italic | `* *` or `_ _` | <kbd>Command</kbd>+<kbd>I</kbd> (Mac) or <kbd>Ctrl</kbd>+<kbd>I</kbd> (Windows/Linux) | `_This text is italicized_` | *This text is italicized* | | | Strikethrough | `~~ ~~` or `~ ~` | None | `~~This was mistaken text~~` | ~~This was mistaken text~~ | | | Bold and nested italic | `** **` and `_ _` | None | `**This text is _extremely_ important**` | **This text is *extremely* important** | | | All bold and italic | `*** ***` | None | `***All this text is important***` | ***All this text is important*** |  | | Subscript | ` ` | None | `This is a subscript text` | This is a subscript text | |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/basic-markdown.md (reported line 92)May include surrounding context.
md
Here are the currently supported color models. | Color | Syntax | Example | Output | | ----- | --------------------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | HEX | <code>\`#RRGGBB\`</code> | <code>\`#0969DA\`</code> | ![Screenshot of rendered GitHub Markdown showing how HEX value #0969DA appears with a blue circle.](https://docs.github.com/assets/images/help/writing/supported-color-models-hex-rendered.png) | | RGB | <code>\`rgb(R,G,B)\`</code> | <code>\`rgb(9, 105, 218)\`</code> | ![Screenshot of rendered GitHub Markdown showing how RGB value 9, 105, 218 appears with a blue circle.](https://docs.github.com/assets/images/help/writing/supported-color-models-rgb-rendered.png) |

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/jekyll.md (reported line 28)May include surrounding context.
md
gem install jekyll bundler # Ubuntu/Debian sudo apt-get install ruby-full build-essential zlib1g-dev gem install jekyll bundler # Windows (use RubyInstaller)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation recommends bundle exec jekyll serve --host 0.0.0.0 without warning that this binds the development server to all network interfaces, making the site reachable from other devices on the network. In a developer-facing reference, this can lead to unintended exposure of draft content, local files served by plugins, or vulnerable dev instances if users copy-paste the command blindly.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reference materially expands the skill from Markdown-to-HTML conversion into a general-purpose document conversion capability, including PDF, Word, LaTeX, EPUB, and reverse conversions. In an agent skill context, this broadens the operational scope and may enable unintended file handling paths, parser surfaces, and workflows beyond the declared purpose, increasing the chance of misuse or unsafe task execution.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/hugo.md (reported line 34)May include surrounding context.
bash
# Debian/Ubuntu sudo apt-get install pandoc # Fedora sudo dnf install pandoc

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/pandoc.md (reported line 30)May include surrounding context.
bash
# Debian/Ubuntu sudo apt-get install pandoc # Fedora sudo dnf install pandoc

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/pandoc.md (reported line 33)May include surrounding context.
bash
# Debian/Ubuntu sudo apt-get install pandoc # Fedora sudo dnf install pandoc

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation includes executable extension points via Lua filters and external pandoc filters, which can run code or invoke external programs during conversion. For a Markdown-to-HTML converter skill, exposing these mechanisms is dangerous because it can normalize or encourage agent behavior that executes untrusted scripts as part of rendering.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documented git submodule and theme retrieval steps introduce network-dependent supply-chain actions unrelated to basic Markdown rendering. Even when presented as examples, these instructions broaden the skill into dependency acquisition and remote content integration, which can lead to unintended downloads or trust of third-party code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guide explicitly demonstrates raw HTML passthrough in Markdown output, including direct rendering of HTML tags, but does not warn that allowing untrusted Markdown or raw HTML can lead to XSS in many markdown-to-HTML pipelines. In the context of a markdown-to-HTML converter skill, this omission is security-relevant because users may copy the behavior into production converters or templates and render attacker-controlled content unsafely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file instructs users to run conversion commands that create or overwrite files such as README.html, but it does not warn that local files will be written as part of the workflow. For markdown files, SQP-2 applies when the description omits warnings about behaviors that could affect user data or system state.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Hidden Instructions

Hidden Instructions

Vague Triggers

Vague Triggers

Session Persistence

Using Config Files

Description-Behavior Mismatch

Context-Inappropriate Capability

Ae4

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Sudo/Root Execution

Missing User Warnings

Description-Behavior Mismatch

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Context-Inappropriate Capability

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Static analysis