Marp — Markdown Presentations

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  1.0.0

Overview

This is a documentation-only Marp helper for making and exporting slide decks, with expected cautions around local files, HTML rendering, and optional third-party diagram tooling.

Install is reasonable for users who want Marp guidance. Before using the examples, only enable local file access, HTML rendering, CDN scripts, or globally installed diagram tools for decks and assets you trust, and serve only directories you intend to expose locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The skill explicitly recommends `--allow-local-files` for PDF export without warning that enabling local file access expands what the renderer can read from the filesystem. In a skill that converts markdown and may process untrusted or externally supplied content, this can increase the risk of unintended local file disclosure or inclusion during rendering.

VirusTotal

63/63 vendors flagged this skill as clean.