MarkItDown Skill

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:45 PM UTC
• Version: 1.0.1

Overview

This skill coherently helps convert documents to Markdown, with optional web, plugin, OCR, and cloud/LLM features that users should handle carefully.

Install in a virtual environment when possible, prefer only the MarkItDown extras you need, avoid enabling plugins unless they come from trusted reviewed sources, and do not send sensitive documents, private URLs, images, audio, or transcripts to external LLM/Azure/YouTube-related workflows unless your policy allows it. Use explicit private output folders and check for existing .md files before batch conversion.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:60

Finding

Unpinned Third-Party Dependencies and Unrestricted Plugin Enablement

Content

View full analysis

Vulnerability Details

File Locations: SKILL.md:60-68, POST_INSTALL.md:41-53, reference.md:254-269, scripts/batch_convert.py:59-62, 80
Vulnerability Type: Uncontrolled third-party dependency and plugin execution
Risk Level: Medium

Relevant Code and Instructions:

SKILL.md:60-68

bash

pip install 'markitdown[all]'

Or install specific formats only:

bash

pip install 'markitdown[pdf,docx,pptx]'

POST_INSTALL.md:41-53

bash

pip install 'markitdown[pdf]'      # PDF support
pip install 'markitdown[docx]'     # Word documents
pip install 'markitdown[pptx]'     # PowerPoint
pip install 'markitdown[xlsx]'     # Excel
pip install 'markitdown[audio-transcription]'   # Audio
pip install 'markitdown[youtube-transcription]' # YouTube

Or install everything:

bash

pip install 'markitdown[all]'

reference.md:254-269

markdown

## Plugin System

### Finding Plugins
Search GitHub for: `#markitdown-plugin`

### Using Plugins

**CLI:**
```bash
markitdown --list-plugins
markitdown --use-plugins file.pdf

Python:

python

md = MarkItDown(enable_plugins=True)

text

`scripts/batch_convert.py:59-62, 80`
```python
parser.add_argument(
    "-p", "--plugins",
    action="store_true",
    help="Enable plugins"
)

python

md_kwargs = {"enable_plugins": args.plugins}

Technical Analysis

The documented installation commands do not pin package versions or verify package hashes. Installing the all extra also expands the transitive dependency set substantially. Consequently, the exact code installed can change over time without any corresponding change to this reviewed Skill.

The plugin documentation compounds this supply-chain exposure by recommending that users discover plugins through an unrestricted GitHub search. The batch converter exposes a command-line switch that enables installed third-party ...[truncated 1528 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin MarkItDown and all approved dependencies to reviewed versions instead of allowing unconstrained resolution.
2. Publish a lock file or constraints file and use package hashes, such as pip's --require-hashes, for reproducible installation.
3. Recommend installing only the format-specific extras required for the task rather than markitdown[all].
4. Replace unrestricted plugin discovery guidance with an explicit allowlist containing reviewed plugin names, versions, hashes, and trusted source locations.
5. Keep plugin support disabled by default and display a clear warning that enabling plugins executes third-party code.
6. Run conversion and plugins in a restricted environment with minimal filesystem access, no unnecessary credentials, and controlled outbound network access.
7. Periodically scan and review the complete resolved dependency graph for known vulnerabilities and unexpected package changes.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/batch_convert.py:21

Finding

Predictable Output Paths Permit Silent Overwrites and Symlink-Following Writes

Content

View full analysis

Vulnerability Details

File Location: scripts/batch_convert.py:21-29
Vulnerability Type: Unsafe output-file handling
Risk Level: Low

Vulnerable Code:

python

# Determine output path
if output_dir:
    output_dir = Path(output_dir)
    output_dir.mkdir(parents=True, exist_ok=True)
    output_path = output_dir / f"{input_path.stem}.md"
else:
    output_path = input_path.with_suffix(".md")

try:
    if verbose:
        print(f"Converting: {input_path}")

    result = md_converter.convert(str(input_path))
    output_path.write_text(result.text_content)

Technical Analysis

Output names are derived predictably from the input stem, and Path.write_text() writes with truncation semantics when the destination already exists. The script neither checks for an existing output nor requires an explicit overwrite option.

Multiple input files with identical stems therefore map to the same filename when a common output directory is used. For example, department-a/report.pdf and department-b/report.docx both map to OUTPUT/report.md, causing the later conversion to replace the earlier result.

In addition, normal file-opening behavior follows an existing symbolic link. If another local user or process can modify the selected output directory, it can create a predictable .md symlink targeting another file writable by the victim. The conversion then writes through that link.

Attack Path

Collision path:

1. A batch contains files from different directories that share the same stem.
2. The user selects one common output directory.
3. Each input is mapped to the same Markdown destination.
4. Later conversions silently overwrite earlier conversion results.

Symlink path:

1. An attacker can modify a shared or otherwise attacker-controlled output directory.
2. The attacker predicts the output name from the input stem and creates that name as a symbolic link.
3. The link ...[truncated 658 chars]

Remediation

View remediation

Remediation Suggestions

1. Refuse to replace existing output files by default and provide an explicit --overwrite option when replacement is intended.
2. Detect duplicate derived output names before starting the batch and fail with a clear collision report.
3. Preserve relative source paths beneath the output directory or append a deterministic unique suffix when different inputs share a stem.
4. Create output files atomically and exclusively, using no-follow semantics where the platform supports them.
5. Reject symbolic-link destinations and verify that the resolved output remains inside the intended output directory.
6. Prefer private output directories with restrictive permissions rather than shared or attacker-writable locations.
7. Specify an explicit text encoding, such as encoding="utf-8", for predictable cross-platform output behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · POST_INSTALL.md (reported line 61)May include surrounding context.

OCR (for images)

bash

# Ubuntu/Debian
sudo apt-get install tesseract-ocr

# macOS
brew install tesseract

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · POST_INSTALL.md (reported line 94)May include surrounding context.

OCR (for images)

bash

# Ubuntu/Debian
sudo apt-get install tesseract-ocr

# macOS
brew install tesseract

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

OCR (for images)

bash

# Ubuntu/Debian
sudo apt-get install tesseract-ocr

# macOS
brew install tesseract

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference.md (reported line 215)May include surrounding context.

OCR (for images)

bash

# Ubuntu/Debian
sudo apt-get install tesseract-ocr

# macOS
brew install tesseract

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill advertises and demonstrates file-writing behavior via -o output.md and a batch conversion utility, but does not declare any tool scope such as permissions or allowed-tools. In an agent setting, undocumented write capability can lead to unintended filesystem modifications and weakens policy enforcement around where outputs may be created.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation encourages converting URLs, web pages, and YouTube content without warning that the tool will make outbound network requests and fetch user-supplied remote resources. In an agent workflow, this can expose internal URLs, trigger SSRF-like access to sensitive endpoints, or leak user intent/data to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill promotes OCR, EXIF metadata extraction, and audio transcription without warning that images and audio may contain sensitive content such as location metadata, faces, IDs, or spoken secrets. Users or agents may process confidential media without realizing the breadth of extracted information or any downstream handling by dependencies/services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide includes an example that sends result.text_content from converted documents directly to an external LLM API, but it does not warn that document contents may contain sensitive, proprietary, or regulated data. In a document-conversion skill, users are likely to process contracts, internal reports, scans, and other confidential material, so normalizing this pattern without a privacy notice can lead to unintended data disclosure to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation encourages enabling third-party plugins but does not warn that plugins execute arbitrary code in the local environment and should be treated as untrusted software. In an agent skill context, users may assume plugins are a normal extension mechanism and unknowingly expand the attack surface to supply-chain or code-execution risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The reference documents optional LLM-based image descriptions and Azure Document Intelligence without warning that document content, images, or metadata may be transmitted to external services. For a document-conversion skill, users may process sensitive files and unintentionally exfiltrate regulated or confidential data to third parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown advertises converting content directly from a web URL using markitdown https://example.com/docs -o docs.md, which implies outbound network access and retrieval of remote content. The README does not include any warning or disclosure about network use, privacy implications, or that remote URLs will be fetched over the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The YouTube transcription example omits notice that requests may contact external platforms or services and may disclose the requested video and related metadata. While the content is often public, enterprise usage can still reveal research interests, internal workflows, or trigger unintended network egress.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.