Web to Markdown Pro

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:04 AM UTC
• Version: 1.0.0

Overview

This is a straightforward URL-to-Markdown helper, with expected network and file-writing behavior plus a normal but unpinned pip dependency users should verify.

Install only if you trust the `web2md` package source. Prefer a virtual environment, consider pinning a reviewed version, and confirm which URLs will be fetched and where Markdown files will be written before running batch or output commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–22
Vulnerability Type: Unpinned and unaudited third-party dependency
Risk Level: Medium

bash

pip install web2md

Technical Analysis

The Skill directs users to install web2md from the configured Python package index without specifying an exact version, cryptographic hash, verified publisher, or canonical source repository. Consequently, the installed artifact may change after the Skill has been reviewed.

This creates a supply-chain trust boundary: installation and subsequent CLI execution run third-party code with the invoking user's privileges. A compromised package publisher, malicious future release, or package-index substitution could therefore introduce attacker-controlled code. The repository contains no implementation files with which to verify the package behavior described in SKILL.md.

Attack Path

1. An attacker compromises the package publisher account, package distribution infrastructure, or another relevant dependency supply-chain component.
2. The attacker publishes a malicious release under the web2md package name.
3. A user follows the Skill's unpinned pip install web2md instruction.
4. Pip resolves and installs the attacker-controlled release from the configured package index.
5. Malicious code executes during installation or when the user invokes the installed web2md command.
6. The code operates with the permissions of the invoking user and can access resources available to that account.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. Depending on the execution environment, this may expose readable files, environment variables, URL lists, generated documents, local service endpoints, and credentials accessible to that user. It could also allow modification of user-owned files and outbound network communication. The Skill itself does no ...[truncated 120 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version rather than installing the latest available release.
2. Publish the package's canonical repository, package-index page, and verified publisher identity so users can validate provenance.
3. Supply a lock file or requirements file containing cryptographic hashes, and install with hash enforcement such as pip install --require-hashes -r requirements.txt.
4. Re-review the package and its transitive dependencies before updating the pinned version.
5. Recommend installation inside a dedicated virtual environment or similarly isolated runtime under a non-privileged account.
6. Where practical, use signed releases, attestations, or a trusted internal package mirror that only contains reviewed artifacts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger text includes broad phrases like 'save this article' and 'extract content from URL' combined with generic wording about processing reading lists, which can cause the skill to activate in contexts the user did not clearly intend. Because this skill performs external network fetches and can write files, overbroad triggering increases the chance of unintended URL retrieval or content export.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description does not warn that using the tool will make outbound requests to arbitrary URLs and may save Markdown to disk. This reduces user awareness and informed consent around network access and filesystem side effects, which is especially risky in automated or agent-driven environments where the skill may be invoked implicitly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.