ClawHub
Back to skill

Security audit

md-to-office

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only Pandoc helper with overly broad examples, including URL input, but no hidden code, installer, persistence, credentials, or automatic network activity.

Install only if you want a general Pandoc command helper, not a strictly local Markdown-to-PDF-only skill. Use local files by default, and approve URL-based conversions only when you intentionally want the agent to fetch and process remote content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest constrains the skill to local Markdown-to-PDF conversion, but the body documents much broader pandoc capabilities including other formats, templates, metadata injection, and web-sourced inputs. This creates scope drift that can cause an agent or user to invoke behavior beyond the approved purpose, increasing the chance of unintended file access, file creation, or network use.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The documentation explicitly advertises converting content directly from a URL, which introduces network access despite the skill being described as a local Markdown-to-PDF converter. That can lead to unauthorized remote fetches, data exfiltration paths, or use of untrusted remote content in a context where operators would reasonably expect only local file handling.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill includes direct web-fetch usage without any warning that it performs network access or ingests remote content. In a supposedly local conversion skill, failing to disclose this behavior increases the risk that an agent or operator triggers unexpected outbound requests and processes untrusted remote data.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.