All to Markdown

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:49 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed local wrapper for converting user-provided files or URLs to Markdown, with no hidden persistence or unrelated access found.

Install only if you are comfortable approving an unpinned third-party Python package with broad optional dependencies. Use it on files and URLs you intentionally provide, and only enable OpenAI/API or plugin features when you want that extra processing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: config.json:8

Finding

Unpinned Third-Party Package with Broad Optional Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:27-31, config.json:8-12, config.json:39-51, and scripts/run.sh:45-48
Vulnerability Type: Unpinned and unnecessarily broad third-party dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:27-31:

markdown

安装 markitdown：

```bash
pip install 'markitdown[all]'

text

`config.json:8-12`:

```json
"runtime": {
  "python": ">=3.10"
},
"binaries": ["markitdown"],
"packages": {
  "pip": ["markitdown[all]"]
}

config.json:39-51:

json

"install": {
  "type": "pip",
  "autoInstall": false,
  "riskLevel": "low",
  "riskReason": "仅安装 markitdown Python 包，在本地执行文件转换，不发送数据到远程服务（除非启用 LLM 功能）。",
  "requiresApproval": true,
  "installCommand": "pip install 'markitdown[all]'"
},
"dependencies": {
  "pip": ["markitdown[all]"],
  "binaries": [],
  "note": "Requires markitdown CLI. Install with: pip install 'markitdown[all]'"
}

scripts/run.sh:45-48:

bash

if ! command -v markitdown &>/dev/null; then
  echo >&2 "错误: markitdown 未安装。请运行: pip install 'markitdown[all]'"
  exit 1
fi

Technical Analysis

The project repeatedly instructs users to install markitdown[all] without an exact version, lock file, or integrity hashes. Consequently, pip may resolve whichever compatible package and transitive dependency versions are available at installation time rather than a specifically reviewed dependency set.

The [all] extra also installs a broader collection of optional dependencies than may be necessary for a particular conversion task. This expands the software supply-chain attack surface and increases the number of packages whose installation and runtime behavior must be trusted. Python package installation may execute package build logic, and installed components later execute within the markitdown process.

The configuration requires installation approval and disables ...[truncated 1795 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin markitdown and every transitive dependency to reviewed, exact versions in a lock file.

2. Generate and verify cryptographic hashes for all downloaded artifacts. Use a command such as:

   bash

   pip install --require-hashes -r requirements.txt
   

3. Replace the broad [all] extra with only the extras required by the supported use cases. Separate optional format support into explicitly approved dependency groups where practical.

4. Install dependencies in a dedicated virtual environment or isolated container rather than the user's global Python environment.

5. Configure pip to use a trusted package index and, where possible, an internally controlled mirror containing reviewed artifacts.

6. Add automated dependency vulnerability and provenance scanning to the release process.

7. Keep autoInstall disabled and requiresApproval enabled, but update the approval prompt and riskReason to disclose the unpinned third-party and transitive dependency risks.

8. Update SKILL.md, config.json, and the error message in scripts/run.sh so every installation path consistently points to the locked and hash-verified requirements file.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language instructions, examples, and safety notes are all presented in Chinese, which effectively forces a specific language for users and downstream agents. The policy allows fixed locale only when the skill offers a language choice or clearly justifies the locale restriction, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest uses Chinese-only natural-language descriptions for user-facing command metadata ("将文件或 URL 转换为 Markdown" and "显示使用帮助"). This imposes a specific language on users without any opt-in, fallback, or documented locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This shell script presents all user-facing help and usage guidance in Chinese, including the command description, options, examples, and environment variable notes. The file does not offer an English alternative or any opt-in language selection, which is a natural-language locale policy issue under the stated rules.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.