Markdown to Word (.docx) Converter

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:22 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but its Mermaid rendering and installation flow use broad local execution in ways users should review before installing.

Install only if you are comfortable with a document converter that may install global/system dependencies and run local browser-based rendering tools. Prefer an isolated environment, pin dependencies, avoid processing untrusted Markdown with Mermaid enabled, and review any sudo or global npm install before allowing an agent to run it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:59

Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Exposure

Content

View full analysis

/dev/null || npm install -g @mermaid-js/mermaid-cli ``` Equivalent unpinned installation instructions also appear in `README.md`. ### Technical Analysis The Skill instructs the agent or user to install `python-docx` and `@mermaid-js/mermaid-cli` without version constraints, integrity hashes, or a lockfile. Consequently, the installed code depends on whichever package versions and transitive dependencies the registries serve at installation time. The npm dependency is installed globally and supplies the `mmdc` executable subsequently trusted by `scripts/md_to_docx.py`. Package installation can also execute npm lifecycle scripts. A compromised maintainer account, malicious transitive dependency, registry compromise, or unsafe future release could therefore introduce arbitrary code after the Skill itself has been reviewed. Although the package names do not appear to be typographical imitations, the installation process lacks controls that would make dependency resolution reproducible and verifiable. ### Attack Path 1. An attacker compromises a named package, one of its transitive dependencies, or the relevant registry distribution channel. 2. The attacker publishes a malicious version or modifies a release resolved by the unpinned command. 3. A user or agent follows the Skill instructions and runs the package installation command. 4. Malicious package lifecycle code executes during installation with the installing user's privileges, or a malicious `mmdc` executable is installed globally. 5. A later Markdown conversion invokes the compromised `mmdc` executable, providing another opportunity for arbitrary local code execution. ### Impact Assessment Successful exploitation could ex ...[truncated 492 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/md_to_docx.py:608

Finding

User-Controlled Mermaid Content Is Rendered with Chromium Sandbox Protections Disabled

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/md_to_docx.py (reported line 678)May include surrounding context.

python

f.write(puppeteer_config)

    try:
        env = os.environ.copy()
        chrome_path = find_chrome_path()
        if chrome_path:
            env['PUPPETEER_EXECUTABLE_PATH'] = chrome_path

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README says that, when no template is provided, the skill defaults to Chinese typography standards, and later enumerates Chinese fonts and formatting as defaults. This is a natural-language locale policy issue because the skill appears to force a specific locale/style by default without explicit user opt-in or a clearly documented region-specific justification.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 45)May include surrounding context.

Chrome 浏览器（Mermaid 渲染引擎）

macOS / Windows 通常已预装，Linux 需手动安装：

sudo apt install google-chrome-stable

text

### 第 2 步：安装 Skill

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 164)May include surrounding context.

Chrome 浏览器（Mermaid 渲染引擎）

macOS / Windows 通常已预装，Linux 需手动安装：

sudo apt install google-chrome-stable

text

### 第 2 步：安装 Skill

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill instructs the agent to read and write local files, inspect common directories for templates, install dependencies, and invoke shell commands, but it declares no explicit tool scope or permission boundaries. That mismatch increases the chance an agent will use powerful capabilities implicitly, without clear user consent or policy enforcement, which can lead to unintended file access or command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger language is broad enough to activate on many general requests involving Word, templates, books, chapters, or Markdown conversion, which can cause the skill to run in contexts the user did not explicitly intend. In this skill, overbroad activation is more dangerous because activation leads directly to file handling, dependency installation, and shell execution recommendations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The usage instructions tell the operator to run pip3 install, potentially npm install -g, and then execute a local Python script and local rendering tooling, but they do not warn about the risks of global package installation, PATH modification, or executing local binaries and scripts. This can expose the environment to supply-chain risk, privilege issues, and accidental execution of untrusted local tooling, especially because Mermaid rendering also depends on browser automation components.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The eval for the no-template English document explicitly expects default Chinese typesetting even when the user did not request it. This can normalize unwanted locale-specific formatting, causing the skill to override user intent and produce misleading or inappropriate output for documents in other languages or contexts. In a document-generation skill, silently imposing formatting defaults is a real safety and quality issue because downstream users may trust the output as intentional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring states that when no template is provided, the script uses default Chinese typesetting settings, including Chinese fonts and formatting conventions. This is a natural-language locale policy constraint presented as a default behavior, with no user opt-in or alternative locale choice documented.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/md_to_docx.py (reported line 103)May include surrounding context.

python

converted = doc_path.rsplit('.', 1)[0] + '_converted.docx'
    if platform.system() == 'Darwin':
        try:
            result = subprocess.run(
                ['textutil', '-convert', 'docx', doc_path, '-output', converted],
                capture_output=True, text=True, timeout=30
            )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/md_to_docx.py (reported line 114)May include surrounding context.

python

# LibreOffice (cross-platform fallback)
    try:
        result = subprocess.run(
            ['libreoffice', '--headless', '--convert-to', 'docx', '--outdir',
             os.path.dirname(converted) or '.', doc_path],
            capture_output=True, text=True, timeout=60

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Rendering Mermaid by invoking mmdc and a browser runtime materially increases the attack surface beyond simple document conversion. If untrusted Markdown is processed, malicious Mermaid payloads could trigger vulnerabilities in Mermaid CLI, Chromium, or Puppeteer, potentially leading to code execution or local file access within the rendering environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/md_to_docx.py (reported line 683)May include surrounding context.

python

if chrome_path:
            env['PUPPETEER_EXECUTABLE_PATH'] = chrome_path

        result = subprocess.run(
            ['mmdc', '-i', mmd_file, '-o', output_path, '-w', '1200', '-H', '800',
             '-b', 'white', '-p', config_file],
            capture_output=True, text=True, timeout=120, env=env

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The README advertises Mermaid rendering through @mermaid-js/mermaid-cli and Chrome, but does not clearly warn users that diagram content is passed to external processes for rendering. In a document-conversion skill, users may process sensitive markdown, so undisclosed handoff to browser/CLI components increases privacy and trust risks, especially if those tools load external resources or behave unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes applying Word templates and automatic style detection, but for .doc inputs the implementation launches textutil or libreoffice subprocesses to convert files before analysis. Spawning office-conversion tools is a broader host capability than straightforward .md to .docx transformation and is not explicitly surfaced in the declared purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.