jinx

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:10 AM UTC
• Version: 1.0.0

Overview

The skill has a clear Markdown-to-PDF purpose, but it automatically runs a mutable third-party npm package at runtime, which creates avoidable code-execution and supply-chain risk.

Install only if you are comfortable with the agent downloading and running the latest `md-to-pdf` npm package during conversion. Prefer a revised version that pins the converter version, uses a lockfile or preinstalled vetted binary, and runs conversion with limited filesystem and environment access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:34

Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 34
Vulnerability Type: Supply-chain risk caused by runtime execution of a mutable dependency
Risk Level: High

Complete Code Snippet:

bash

export PATH="$HOME/.homebrew/bin:$PATH" && npx -y md-to-pdf@latest <输入文件.md> --pdf-options '{"format":"A4","margin":{"top":"20mm","bottom":"20mm","left":"15mm","right":"15mm"}}'

Technical Analysis

The skill instructs the agent to run npx -y md-to-pdf@latest. The -y option suppresses the installation confirmation, while @latest resolves to a mutable package release at execution time. Consequently, the code executed in a future invocation may differ from the code available when this skill was audited.

No exact package version, lockfile, package integrity hash, trusted internal registry, or prior review requirement is specified. Because npm package lifecycle and runtime code execute with the invoking user's permissions, compromise of the package, its publisher account, or its dependency chain could turn the documented conversion command into an arbitrary-code execution mechanism.

This finding concerns unsafe dependency acquisition rather than confirmed malicious behavior by the currently published package.

Attack Path

1. An attacker compromises the md-to-pdf publisher account, package, or transitive dependency chain.
2. The attacker publishes a malicious release that becomes the version selected by the latest distribution tag.
3. An agent follows the skill while processing a Markdown report.
4. npx -y retrieves and executes the attacker-controlled package without interactive approval.
5. The malicious package runs with the permissions of the agent process and can access resources available to that operating-system user.

Impact Assessment

Successful exploitation permits arbitrary code execution under the invoking user's account. Potentially exposed resources include the Markdown re ...[truncated 419 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version.
2. Declare the dependency in a project manifest and commit a lockfile that records exact transitive versions and integrity values.
3. Install dependencies during a controlled setup or build phase rather than downloading and executing them during report conversion.
4. Avoid npx -y for runtime acquisition. Execute a previously installed, verified local binary instead.
5. Configure npm to use an approved registry and verify package provenance and integrity before installation.
6. Review package updates before changing the pinned version, including changes to transitive dependencies.
7. Run PDF conversion in a sandbox with restricted filesystem access, minimal environment variables, no unnecessary credentials, and constrained network access.
8. Add failure handling that refuses conversion if the verified dependency is unavailable rather than silently fetching an unreviewed release.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and body are written to enforce report conversion behavior specifically for WeChat/Feishu users, and the skill content is presented only in Chinese with no indication that users can choose another language or locale. The policy requires flagging language or locale constraints when a skill forces a specific language without explicit opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill invokes npx -y md-to-pdf without a pinned version, allowing whatever package version is current at execution time to be downloaded and run. Because npx executes package install scripts and package code, this creates a supply-chain and runtime code execution risk that is unnecessary for a deterministic local file conversion task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The command npx -y md-to-pdf@latest explicitly downloads and executes the latest published package at runtime, giving remote third-party code execution capability every time the skill runs. In this context, the skill only needs Markdown-to-PDF conversion, so live execution of mutable remote code is disproportionate and materially increases supply-chain compromise risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The '失败处理' section claims the skill will degrade gracefully by sending the original .md file when conversion fails. However, the only concrete operational command shown is the md-to-pdf invocation, with no code or command flow implementing the fallback, so the stated handling diverges from the actual documented behavior available in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.