Security audit

mdapi.io

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently documents a third-party conversion service, with disclosed data sharing, bounded storage, and consent controls for payments.

Use this service only for content you authorize mdapi.io to process. Set ttl=0 to disable document caching, and keep resource and task identifiers private. Crypto payments are irreversible; use explicit approval or a wallet with a spending limit. Retention statements describe the service's claims, not independently verified guarantees.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (43)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: mdapi-conversion description: Use mdapi.io to transform files and webpages into AI-ready Markdown or structured data, with prompt-driven transformation, streaming, x402 payments, token activation, and REST/MCP/ACP/A2A/OpenAI-compatible access. version: 1.0.0 security: classification: data-transform third_party: true payment: irreversible: true requires_consent: true autonomous: gated max_autonomous_retries: 1 credential_handling: secret-store-only --- # mdapi.io - Minimal Data API I/O: a content transformation layer primitive for AI systems. Transforms files and webpa

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 833)May include surrounding context.
md
Apple property lists and Xcode projects: the settings, the targets and the build phases. - PLIST - STRINGS - PBXPROJ

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1100)May include surrounding context.
md
A file travels as a data URI (`data:<mime>;base64,...`) and the declared MIME is what the service reads - the file name is consulted only when the type is absent or carries no format, and failing that the leading bytes are inspected. | Declared MIME in the data URI

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1103)May include surrounding context.
md
plication/x-qfx`, `application/x-usda`, `chemical/x-mdl-molfile`, `chemical/x-mdl-sdfile`, `model/vrml`, `text/x-ass`, `text/x-ssa`, `application/x-ifc`, `text/x-protobuf`, `text/x-thrift`, `text/x-capnp`, `text/x-flatbuffers`, `text/x-graphql-sdl`, `application/x-avsc`, `text/x-abaqus-input`, `text/x-openfoam`, `text/x-gmsh`, `text/x-vtk-legacy`, `text/x-smiles`, `text/x-mol2`, `application/x-hl7-v2`, `application/x-edifact`, `text/x-wat`, `text/x-wast`, `application/x-tfstate`, `text/x-gerber`

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 1101)May include surrounding context.
md
| How it is read | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 1102)May include surrounding context.
md
ument.text-template`, `application/vnd.oasis.opendocument.spreadsheet-template`, `application/vnd.oasis.opendocument.presentation-template`, `application/vnd.oasis.opendocument.text-master`, `application/vnd.android.package-archive`, `application/x-ios-app`, `application/java-archive`, `application/x-wheel`, `application/vsix`, `application/x-xpinstall`, `application/x-nupkg`, `application/vnd.google-earth.kmz`, `application/x-scratch-project`, `application/x-android-app-bundle`, `application/x-plist`, `text/x-strings`, `text/x-pbxproj`, `application/bson`, `application/rdf+xml`, `text/turtle`, `application/trig`, `application/n-triples`, `application/n-quads`, `application/ld+json`, `text/n3`, `application/vnd.pmtiles`, `application/x-emf`, `application/x-wmf`, `application/x-xtc`, `application/x-gromacs-trr`, `application/x-dcd`, `application/x-gromacs-edr`, `application/x-gromacs-tpr`, `text/x-gromacs-gro`, `text/x-gromacs-g96`, `text/x-gromacs-top`, `text/x-gromacs-itp`, `text/x-gr

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1166)May include surrounding context.
md
Every parameter below works on every protocol (REST query/JSON, MCP tool arguments, ACP per-call params, A2A message data, OpenAI request body) and combines freely with `input`. | Parameter | Values | Description

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1168)May include surrounding context.
md
-------------------------------------------------------------------------------------------------------------- | | `result` | `markdown`, `prompt`, `both`, `meta` | What the answer is: `markdown` (the converted text layer), `prompt` (the model's answer to `prompt`), `both`, or `meta` - a reconnaissance answer that reports the parts of the document and their sizes, and no content: the shape of the answer, reported before the content itself is fetched.

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1169)May include surrounding context.
md
document's natural boundary - page (PDF), slide (presentations), sheet (spreadsheets), chapter (EPUB and archives, an expanded `.tar.zst` included) - or one A4 sheet of text for formats without one; the units table says which format owns which. Every response self-describes the range in `parts` (JSON body) and `X-MDAPI-Parts` / `X-MDAPI-Part-Unit` (headers), so the count never has to be guessed. `part` also decides how a resource larger than the input gate is read - see the addressability table. | | `find` | literal substrings, whitespace-separated (no wildcards, no regu

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1171)May include surrounding context.
md
rts what it searches - so it costs and consumes exactly what the same request without `find` would. | | `capacity` | `low`, `medium`, `high`, `max` | Working window of the paid LLM stage, symmetric in input and output tokens: `low` (the 16K floor inside the minimum price), `medium`, `high`, or `max` - the whole selected input, and the default. It narrows what is sent to the model, never what is returned: the markdown a caller receives is not cut.

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1172)May include surrounding context.
md
| | `ttl` | seconds, honored as named (`0` disables; above a year - 31536000 - clamps to it) | How long the converted markdown may be reused. Reuse is the caller's to ask for: without `ttl` a paid request keeps nothing, the free testing tier keeps a short default, and `ttl=0` stores nothing. A named `ttl` is also the consent to store what `includes=attachments` returns - the images then travel as temporary `GET /att/{id}` links with this lifetime instead of inline data URIs.

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1211)May include surrounding context.
"find":{"needle":"revenue","matches":2,"hits":[{"part":137,"offset":4021},{"part":188,"offset":96}]}}

text
| Field | Meaning | | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `find.needle` | The search string that was given to `find`, trimmed. Whitespace inside it separates terms, so `find=pay court` asks a different question than `find=paycourt` - every term

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1236)May include surrounding context.
GET /?input=mdapi:1-&prompt=What+does+it+say+about+revenue

text
| Field / header | Meaning | | ------------------------------------- | ---------------------------------------------------

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1250)May include surrounding context.
md
Whether a large resource is still readable, and on what condition, follows from its format - decide before fetching it: | Formats | Above the input gate | Why | | ------------------------------------------------- | ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DOCX, XLSX, XLSM, XLSB, PPTX, ODT, ODS, ODP, EPUB | By the extension a

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1263)May include surrounding context.
md
`includes=attachments` keeps the images the document carries instead of dropping them. On GET they arrive inline in the markdown; on POST the same images are indexed in `attachments[]`, one entry per image: | Field | Meaning | | ------------------- | ------------

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1265)May include surrounding context.
md
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` | The image's own name when the document carries one, otherwise its `img-N` placeholder - the same string the markdown uses as alt text

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1266)May include surrounding context.
md
| | `mimeType` | The image type (`image/png`, `image/jpeg`, ...)

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1267)May include surrounding context.
md
| | `size` | Length in bytes - what fetching this one image would transfer

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1268)May include surrounding context.
md
| | `placeholder` | The `img-N` token this entry replaced in the markdown. That reference resolves to an inline data URI, or to `url` when `ttl` is set

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1269)May include surrounding context.
md
| | `width` / `height` | Pixel size read from the image header. Absent when the header could not be read; the two are always present together or both absent, and an absent pair never means zero pixels

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1271)May include surrounding context.
md
: their anchor is a per-character reference the native extractor does not read, so they arrive as one block at the end | | `part` | The document part this image's placeholder stands in, counted by the same boundaries `part` selects by - so `part=7` is exactly the request that brings this image. Absent for an archive read by parts, whose chapters are numbered by the archive and not by the markdown the request received. An image the document reuses carries the part it first appears in | | `url` / `expiresAt` | Link mode only (an explicit `ttl`): the temporary `GET /att/{id}` link and when it stops working. In

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1272)May include surrounding context.
md
| | `url` / `expiresAt` | Link mode only (an explicit `ttl`): the temporary `GET /att/{id}` link and when it stops working. Inline mode carries neither - the bytes are already in the markdown, and the array stays an index without them

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1393)May include surrounding context.
md
### Content warnings | Field / header | Meaning | | ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1626)May include surrounding context.
md
`POST /v1/responses` speaks the OpenAI Responses API against the same core. `input` takes a string or an array of items and `instructions` becomes the system message. | Part or field | Meaning | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `input` | A string, or an array of items. A bare string, or an item whose `content` is a string, is read as one message; an item whose `content` is an array carries parts. `instruct

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 1629)May include surrounding context.
md
------------------------------------------------------------------------------------------------------------------------------------- | | `input` | A string, or an array of items. A bare string, or an item whose `content` is a string, is read as one message; an item whose `content` is an array carries parts. `instructions` becomes the system message | | `input_text` / `text` | The text of a part | | `input_file` | One file per request. `file_data` is a data URI (`data:<mime>;base64,...`); `file_url` is an http(s) URL or a data URI. `file_id` on its own is refused with an explanation, because the service is stateles

Static analysis

No suspicious patterns detected.