Markdown To Word Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:28 AM UTC
• Version: 1.0.0

Overview

This Markdown-to-Word skill is mostly purpose-aligned, but it needs Review because Markdown image paths can cause local image files to be embedded and its shared temporary-file cleanup is under-scoped.

Use this skill only for Markdown files you trust, or run conversion in a sandbox with access only to the intended input, image, and output folders. Be careful with image references, confirm output paths before batch conversion, install dependencies in a virtual environment, and avoid sudo unless you deliberately need system Python packages.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/md2docx_with_images.py:207

Finding

Arbitrary Local File Inclusion Through Markdown Image References

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/md2docx_with_images.py:156

Finding

Predictable Shared Temporary Files and Overbroad Wildcard Cleanup

Content

View full analysis

str: """获取临时图片路径""" import tempfile import hashlib # 生成唯一文件名 file_hash = hashlib.md5(original_path.encode()).hexdigest()[:8] ext = os.path.splitext(original_path)[1] temp_dir = tempfile.gettempdir() temp_filename = f"md2docx_{file_hash}{ext}" return os.path.join(temp_dir, temp_filename) def cleanup_temp_files(self): """清理临时文件""" import tempfile import glob temp_dir = tempfile.gettempdir() temp_pattern = os.path.join(temp_dir, "md2docx_*") temp_files = glob.glob(temp_pattern) for temp_file in temp_files: try: os.remove(temp_file) if self.debug: print(f"🧹 清理临时文件: {temp_file}") except: pass ``` ### Technical Analysis Temporary output names are deterministically generated from the original path using only the first eight hexadecimal characters of an MD5 digest. Files are placed directly in the operating system's shared temporary directory without exclusive creation or a private per-process directory. A local attacker who can write to the shared temporary directory may predict or pre-create the destination. Depending on platform behavior and the image library's save semantics, this can create a symlink or file-replacement race that redirects writes or corrupts another conversion. The cleanup routine separately uses the global pattern `md2docx_*` and deletes every matching entry. It does not track file ownership or limit deletion to files created by the current converter instance. Concurrent conversions can therefore delete one another's temporary files, and an attacker can deliberately create matching files to trigger unintended de ...[truncated 1434 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

--hash=sha256: Markdown== --hash=sha256: beautifulsoup4== --hash=sha256: Pillow== --hash=sha256: ``` Install with: ```bash python -m pip install --require-hashes -r requirements.txt ``` ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 4)May include surrounding context.

sh

# 解码base64图片
echo "🖼️  解码测试图片..."
base64 -d test_images/sample.jpg.base64 > test_images/sample.jpg
rm test_images/sample.jpg.base64

# 创建配置文件
echo "⚙️  创建配置文件..."

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

L006-L007 仅说明“当用户需要将Markdown文件转换为Word文档时激活此技能”，这是功能描述式触发条件，而不是明确、受限的调用条件。文档没有提供具体触发短语、适用上下文或不应触发的负面示例，容易导致在泛泛提到转换需求时被误调用。

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

系统依赖（可选）

bash

# Ubuntu/Debian
sudo apt-get install python3-pip python3-venv

# macOS
brew install python3

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

L074-L094 展示了多个将 Markdown 转换为 .docx 的命令用法，本质上会在指定路径创建或覆盖输出文件。虽然这是技能的核心用途，但当前说明缺少显式的用户提示，例如输出文件会写入磁盘、批量模式会在输出目录生成多个文件，以及应避免指向重要现有文件。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The shell script uses Chinese comments, status messages, and generated template/config text throughout, including Chinese style labels and instructions. This enforces a specific language/locale for users without any opt-in mechanism or indication that the skill is intentionally limited to a Chinese-language context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The function docstring and CLI indicate that callers can control max_width, max_height, image_quality, and add_captions. However, _add_image hard-codes max_width=1200, max_height=800, quality=85 at L238-L243, and always adds captions when alt exists at L250-L253, so the documented intent contradicts actual behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

全文以中文编写，并以中文定义技能名称、说明、用法和输出示例，但没有说明该技能仅面向中文用户，或提供其他语言选项。若组织要求技能不应在未获用户选择时强制特定语言，这种单一语言呈现可能构成语言/locale 政策问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code emits user-facing status, error, and CLI help text entirely in Chinese, including prints and argparse descriptions. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains natural-language strings and docstrings exclusively in Chinese, beginning with the module docstring and continuing through CLI help text. Under the policy, forcing a specific language without opt-in can be a locale-policy violation when no alternative language choice or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This code ensures the output directory exists and then invokes a conversion routine that writes to the specified output path. Although file output is part of the tool's purpose, this file contains no confirmation prompt, visible logging, or explanatory comment/docstring warning the user that it will create directories and write files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.