Security audit

md-to-office

Security checks for vulnerabilities and agentic risk

Overview

The skill is a simple Pandoc instruction file, but it broadens a local Markdown-to-PDF skill into general document conversion and even web fetching without clear scoping.

Review before installing. This does not show malware, persistence, credential theft, or destructive behavior, but it should be tightened so agents use it only for local Markdown-to-PDF conversion unless the user explicitly requests broader Pandoc operations or URL fetching.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill is presented as local-only, yet it includes instructions to fetch content from a remote URL. This creates a capability mismatch that can lead agents to perform network access when users or platform policy may assume purely local file handling, increasing the chance of SSRF-like behavior, privacy leaks, or unintended external requests.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest scopes this skill to local Markdown-to-PDF conversion, but the body documents broad pandoc usage across unrelated formats and sources. That scope drift can cause an agent to invoke the skill for unintended transformations or inputs, including riskier operations than the declared capability, undermining user expectations and policy controls.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The URL-fetching example normalizes external network access without warning the user that content will be retrieved from the internet. Even as an example, this can prompt agent behavior that exposes metadata, reaches untrusted resources, or violates least-privilege expectations for a nominally local conversion skill.

Static analysis

No suspicious patterns detected.