Security audit

Convert Markdown To HTML And PDF - Markdown和HTML、PDF互转

Security checks for vulnerabilities and agentic risk

Overview

This document-conversion skill is understandable, but it needs Review because crafted inputs could make it read unintended local files or create HTML with active content.

Install only if you trust the documents and paths being converted. Avoid using it on attacker-supplied project folders, symlinks, Markdown, HTML, or titles, and render generated HTML/PDF in an isolated viewer rather than a trusted application origin. Prefer a hardened version that resolves real paths under the project root, rejects symlinks, escapes titles, sanitizes HTML, and pins dependencies.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: md2html.py:25
Finding: Project Path Restriction Can Be Bypassed Through Symbolic Links
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: md2html.py:53
Finding: Untrusted Markdown and Title Values Can Inject Active Content into Generated HTML
Content: View full analysis
str: """包装为完整 HTML 文档。""" return ( "\n" "\n" "\n" " \n" f" {title}\n" " \n" " body { font-family: system-ui, sans-serif; line-height: 1.6; max-width: 720px; margin: 1em auto; padding: 0 1em; }\n" " pre { background: #f5f5f5; padding: 0.75em; overflow-x: auto; }\n" " code { background: #f5f5f5; padding: 0.2em 0.4em; }\n" " table { border-collapse: collapse; }\n" " th, td { border: 1px solid #ddd; padding: 0.4em 0.6em; }\n" " \n" "\n\n" f"{body}\n" "\n" ) def md_to_html(content: str, standalone: bool = True, title: str = "Document") -> str: """Markdown 转 HTML。""" try: import markdown except ImportError: return {"error": "missing_dependency", "message": "Install: pip install markdown"} html_body = markdown.markdown( content, extensions=["extra", "codehilite", "tables"], extension_configs={"codehilite": {"css_class": "highlight"}}, ) if standalone: return _html_document(html_body, title=title) return html_body ``` The affected title is accepted and passed to this code at lines 112-116: ```python title = (req.get("title") or "Document").strip() or "Document" html = md_to_html(content, standalone=True, title=title) ``` ### Technical Analysis The `title` value is interpolated directly into the HTML `` element without context-appropriate HTML escaping. A malicious value containing `` can terminate that element and inject additional tags i ...[truncated 2390 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:22
Finding: Dependency Installation Instructions Use Unpinned Packages Without Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill advertises local file-based conversion and explicitly accepts a user-supplied path, but it does not declare any tool scope or permissions boundary for file access. That mismatch can let an agent read arbitrary local files under the guise of document conversion, increasing the risk of unintended data exposure if the skill is invoked on attacker-influenced paths.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger description includes broad wording such as 'or similar document format conversion', which can cause the agent to invoke the skill in situations beyond its narrowly intended use. Over-broad activation is risky here because the skill can read local files and transform content, potentially exposing sensitive data or causing unintended file handling from loosely matched user requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The generated HTML document hard-codes lang="zh-CN", which imposes a specific language/locale setting on output for all users. The file does not provide an option to choose another locale or document that this is intentionally limited to a China-specific use case.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.