Markitdown-Skill-for-non-multimodal-agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:24 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but its setup runs unpinned third-party code that can read local documents and may use an API key.

Install only in a constrained environment. Pin package versions or commit SHAs before use, run conversion with access limited to the specific document and output directory, avoid broad filesystem mounts, and provide OCR API credentials only when you intentionally need vision-based OCR. Do not persist converted sensitive documents to a knowledge store unless the user explicitly wants that.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:60

Finding

Execution of Unpinned Third-Party and Git-Hosted Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60, 85–87, and 121–124
Vulnerability Type: Unpinned and mutable software dependencies
Risk Level: Medium

Vulnerable Code

bash

uvx markitdown-mcp

bash

pip install "git+https://github.com/Self-made-Orange/markitdown.git#subdirectory=packages/markitdown[all]"
pip install "git+https://github.com/Self-made-Orange/markitdown.git#subdirectory=packages/markitdown-ocr"
pip install openai

bash

uvx --from "git+https://github.com/Self-made-Orange/markitdown.git#subdirectory=packages/markitdown[all]" \
    --with "git+https://github.com/Self-made-Orange/markitdown.git#subdirectory=packages/markitdown-ocr" \
    --with openai \
    markitdown "<abspath>" --use-plugins --llm-client openai --llm-model "${MARKITDOWN_OCR_MODEL:-gpt-4o-mini}"

Technical Analysis

The documented installation and execution commands resolve packages without fixed versions, cryptographic hashes, lockfiles, or immutable Git commit references. The OCR components are fetched directly from a GitHub fork through a mutable repository reference rather than an audited commit SHA or integrity-verified release artifact.

Both pip install and uvx may execute package installation logic and subsequently run downloaded code. The one-shot uvx command is particularly sensitive because it retrieves and executes newly resolved code in the same workflow. Consequently, the code actually executed can differ from the content that was previously reviewed.

This creates a software supply-chain risk. A compromised package registry account, GitHub repository, mutable branch, upstream release, or transitive dependency could introduce attacker-controlled code. No evidence establishes that the currently referenced projects are malicious; the vulnerability is the absence of controls ensuring that future installations execute the reviewed versions.

Attack Path

1. An ...[truncated 1801 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every package to a reviewed exact version instead of resolving the latest available release.
2. Pin Git dependencies to audited full commit SHAs rather than mutable default branches or repository references.
3. Use a lockfile or fully constrained requirements file that also pins transitive dependencies.
4. Require cryptographic hashes for downloaded packages, such as with pip --require-hashes, and verify release provenance or signatures where available.
5. Prefer trusted, versioned release artifacts from an established package registry over direct installation from a mutable personal fork.
6. Mirror approved artifacts into a controlled internal registry after security review.
7. Run conversion tools in an isolated sandbox or container with:
   • A read-only filesystem except for a dedicated output directory.
   • Access restricted to the specific input document.
   • No unnecessary host-directory mounts.
   • Network access disabled for local conversion and allowlisted only when OCR is explicitly required.
   • A narrowly scoped API credential supplied only to the OCR subprocess.
8. Separate dependency installation from document processing. Build and scan a fixed environment in advance rather than downloading executable dependencies when handling an attachment.
9. Add automated dependency scanning and periodic review of pinned versions before controlled upgrades.
10. Document the exact reviewed package versions and Git commit SHAs so operators can verify that the runtime matches the audited configuration.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs operators to run uvx markitdown-mcp without pinning a specific version or immutable source. That means future executions may fetch and run a newer or compromised package version, creating a supply-chain risk in a component that can read local files and process untrusted documents. The skill context increases risk because the MCP server runs with local user privileges and is explicitly granted access to attachment paths.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.