Markdown to Word

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:08 AM UTC
• Version: 0.4.0

Overview

This skill is a straightforward Markdown-to-DOCX converter that uses local files and pandoc in a disclosed, purpose-aligned way.

Install this only if you are comfortable with the agent running the local pandoc executable and reading the Markdown, template, metadata, and resource files you point it at. Review output paths before use because the script will create parent directories and write DOCX files there.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to invoke a local Python script, read Markdown and template files, write DOCX output, and rely on shell-executed tooling via pandoc, but it declares no explicit tool scope such as allowed-tools or permissions. This creates an authorization gap where an agent may execute file and shell-capable actions without a clearly constrained contract, increasing the chance of overbroad file access or unsafe command use when handling user-supplied paths and templates.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build_builtin_templates.py (reported line 439)May include surrounding context.

python

def build_default_reference(pandoc: str, destination: Path) -> None:
    reference_bytes = subprocess.check_output(
        [pandoc, "--print-default-data-file", "reference.docx"]
    )
    destination.write_bytes(reference_bytes)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/markdown_to_docx.py (reported line 212)May include surrounding context.

python

command = build_command(pandoc, source_path, output_path, template_path, args)
        if args.print_command:
            print(" ".join(command), file=sys.stderr)
        completed = subprocess.run(command, check=False)
        if completed.returncode != 0:
            return completed.returncode
        print(

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill's stated purpose is document conversion, but the implementation invokes pandoc through subprocess.run, giving the skill process-execution capability beyond simple in-process file transformation. Spawning external commands is not declared in the manifest description and is a context-sensitive capability that carries broader execution implications than a typical formatter/converter interface suggests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The inline comment on L196 is written in Chinese while the rest of the file and CLI-facing text are in English. This creates an implicit language constraint for maintainers or reviewers without offering any language choice or documented justification, which matches the locale/language policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.