Security audit

Academic Formula Converter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent document converter, but it has under-scoped local file embedding and unsafe HTML output behavior that users should review before installing.

Install only if you trust the Markdown you convert or are willing to inspect it first. Avoid converting untrusted files that contain image references or raw HTML, and do not share generated DOCX/HTML files without checking their embedded images and content. Prefer a hardened version that restricts images to the chosen image directory, sanitizes HTML, escapes titles, and pins dependencies.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: formula_converter.py:69
Finding: Markdown Image References Can Embed Arbitrary Readable Local Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: formula_converter.py:100
Finding: Unsanitized Markdown and Title Content Produce Active HTML
Content: View full analysis
{title} body{{font-family:"SimSun",serif;line-height:1.8;padding:40px;max-width:900px;margin:0 auto}} h1{{text-align:center;font-size:22pt}}h2{{font-size:16pt;border-bottom:1px solid #ccc}} h3{{font-size:14pt}}p{{text-align:justify}}img{{max-width:100%;display:block;margin:20px auto}} table{{border-collapse:collapse;width:100%}}th,td{{border:1px solid #333;padding:8px;text-align:center}} {html}''' with open(html_path, 'w', encoding='utf-8') as f: f.write(html_content) ``` ### Technical Analysis The converter passes untrusted Markdown to `markdown.markdown()` without sanitizing the resulting HTML. Python-Markdown is a Markdown parser, not an HTML sanitizer, and raw HTML embedded in Markdown can remain active in the output. The document title is also interpolated directly into the `` element. Because the title is obtained from the first level-one Markdown heading, a malicious title can terminate the element and inject additional HTML. A generated HTML file can therefore contain scripts, event handlers, dangerous links, or other active elements supplied by the Markdown author. No Content Security Policy is added to reduce the consequences. ### Attack Path 1. An attacker creates a Markdown document containing active HTML, for example: ```markdown # Report <img src="invalid" onerror="alert(document.location)"> ``` Alternatively, the first heading can attempt to terminate the title ...[truncated 933 chars]
Remediation: View remediation
`, event attributes, malformed title tags, `javascript:` links, SVG-based active content, and encoded variants. Example title hardening: ```python from html import escape safe_title = escape(title or "Academic Paper", quote=True) ``` Sanitization must be performed on the generated body using a deliberately minimal allowlist; escaping only the title is not sufficient. ]]>

T08 · Insecure Dependencies

Note

Location: SKILL.md:56
Finding: Dependency Installation Instructions Use Unpinned Packages Without Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger phrases are broad enough to match ordinary academic assistance requests, which can cause the skill to activate outside its intended narrow use case. Over-broad activation increases the chance of accidental invocation, response hijacking, or inappropriate handling of user content by a conversion-oriented skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The natural-language instructions and headings are presented in Chinese, while the skill does not state that it is intended only for Chinese-speaking users or offer an alternative language option. This can constitute a language-policy issue when users are not given a choice or clear notice of the locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module description, dependency error message, CLI description, and argument help text are all presented only in Chinese. This imposes a specific language/locale on users without any opt-in or documented justification, which matches the language-policy concern for natural-language content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.