Security audit

Own Style Writer

Security checks across malware telemetry and agentic risk

Overview

This skill coherently supports user-directed writing-style extraction and drafting, with disclosed local file processing and opt-in MinerU uploads.

Install only if you are comfortable letting the agent read the style/content directories you name and write generated corpora and drafts to an output folder. Do not use MinerU upload for confidential files unless you accept sending those documents to a third-party service. In stricter environments, prefer local MarkItDown mode and review or pin the Python dependencies before first use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (33)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill directs the agent to read and write local files, inspect environment variables, invoke shell commands, and optionally upload document contents to an external MinerU service, yet it declares no explicit permissions. That mismatch weakens user awareness and policy enforcement: a user may trigger the skill expecting a pure writing workflow while it can access broad local content and perform network exfiltration of uploaded documents.

Context-Inappropriate Capability

Medium

Confidence: 81% confidence
Finding: The script can bootstrap a separate runtime and install inferred MarkItDown extras based on file types before processing local documents. In a writing skill, this expands the attack surface by performing environment setup and dependency installation, which can introduce supply-chain risk or unexpected code execution pathways if package sources or bootstrap behavior are compromised.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The plugin loader imports and executes arbitrary third-party entry points via entry_point.load() and then calls plugin.register_converters(...). That is an extensibility feature, but in a skill intended for local document/style processing it expands the trusted code boundary to any installed package exposing the markitdown.plugin entry point, which can execute code at load or registration time.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The converter accepts arbitrary http/https URIs and fetches them directly with requests without host restrictions, scheme narrowing beyond HTTP(S), or network isolation. In the context of a writing/style-processing skill that is described primarily around local user materials, this introduces unnecessary outbound network capability and can be abused for SSRF-style access to internal services or unintended data egress.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: This converter sends document bytes to Azure Content Understanding for analysis, which is a real security/privacy concern when the surrounding skill is presented as primarily local/offline conversion with only conditional remote use. In a writing-style skill that may process sensitive local files, undisclosed or insufficiently gated network transmission expands the trust boundary and can expose user content to a third-party service.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The module advertises support for remote processing of images, audio, and video via Azure, which exceeds the narrow document-conversion expectations implied by the skill context. That capability increases the chance that users unintentionally submit broader and more sensitive local media to a cloud service, especially in a tool expected to learn writing style from local materials.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: This converter sends full document contents to an external Azure Document Intelligence endpoint for processing, which creates a real data-exposure boundary. In a skill that processes local user files such as PDF/DOCX/PPTX/Excel/HTML/text, this is more dangerous because users may assume conversion is local unless the remote-processing behavior is made explicit and consented to.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: This function reads the entire local file stream, converts it to a data URI, and sends it to an external LLM API for captioning. In the context of a skill described as primarily local document/style processing with optional user-approved upload flows elsewhere, this code creates a real data-exfiltration path for image content without any evidence here of consent checks, data minimization, or scope restriction, so sensitive embedded images could be disclosed to a third party.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The code calls `recognizer.recognize_google(audio)`, which submits audio content to Google's speech-recognition service over the network. In the context of a writing/style-analysis skill, this creates an undeclared external data flow for potentially sensitive user content and expands the skill's capabilities beyond its stated purpose.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: This bundled converter adds speech-to-text handling for audio formats (`wav`, `aiff`, `flac`, `mp3`, `mp4`) even though the skill description emphasizes document and writing-style extraction from local files such as PDF, DOCX, PPTX, Excel, HTML, and text. That mismatch increases attack surface and can cause users or reviewers to miss that audio inputs may be accepted and processed, including by a remote service path.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The converter performs outbound transcript retrieval as part of document conversion, which expands behavior from local HTML parsing into network-dependent access to YouTube transcript infrastructure. In a skill intended to process local user materials, this can leak accessed video IDs, create unexpected external requests, and violate user or deployment expectations around offline-only conversion.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The description uses broad activation cues such as '按我的文章风格写' and '学习某个目录里的文风', which can cause the skill to trigger in many ordinary writing conversations. In this skill, overbroad triggering is more dangerous because activation can lead to directory inspection, file conversion, shell execution, and optional third-party uploads, expanding the chance of unintended access to sensitive user documents.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The client uploads local files and later downloads processed content from third-party MinerU endpoints, but this module itself contains no user-consent, warning, or policy enforcement mechanism. In a skill that processes potentially sensitive local documents, silent exfiltration to an external service can violate user expectations and leak confidential data if the caller does not clearly gate this behavior.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: When --allow-upload is enabled, the code sends local documents to the remote MinerU precise service, but the network transmission point does not itself provide a strong runtime disclosure or confirmation tied to the specific files being uploaded. In a writing-style skill that processes arbitrary local user documents, this can expose sensitive manuscripts, business files, or personal records to a third party without sufficiently explicit informed consent at the moment of transfer.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The MinerU agent path uploads local files one-by-one through convert_agent_file after only checking args.allow_upload, without a nearby runtime warning or per-file disclosure. Because this skill is specifically designed to ingest local PDFs, Office files, emails, images, and similar materials, silent or weakly disclosed uploads materially increase privacy and confidentiality risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code reads the full file and submits it to Azure with begin_analyze_binary() without any in-code disclosure, warning, or consent mechanism. In this skill context, where local user files may contain confidential drafts or source materials, silent exfiltration to a remote processor is a meaningful privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code reads the entire uploaded file and submits it to Azure Document Intelligence without any user-facing notice or consent mechanism in this file. For a writing-style skill that may ingest sensitive private documents, undisclosed third-party transmission materially increases privacy and compliance risk even if the implementation is not malicious.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This code packages the full image contents into a base64 data URI and sends it to an external LLM service via `client.chat.completions.create(...)` without any disclosure, consent, or policy enforcement in this component. Images can contain sensitive visual content and embedded personal or location metadata, so silent transmission to a third-party model provider creates a real privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The API call transmits base64-encoded image contents to an external service with no user-facing warning, inline disclosure, or visible consent enforcement in this code path. That is dangerous because users may reasonably expect local conversion behavior, while private screenshots, scanned documents, or embedded images could be silently exposed to a remote provider.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: When both `llm_client` and `llm_model` are provided, the converter sends raw embedded slide images to `llm_caption()` for caption generation with no consent check, policy gate, or visible disclosure in this code path. PPTX files often contain sensitive screenshots, diagrams, or personal data, so this can cause unintended exfiltration of document contents to an external AI service during a local file conversion workflow.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The call to Google's recognizer transmits user-provided audio to a third-party service without any warning, consent flow, or disclosure in this code path. If users provide private recordings or embedded speech in local files, this can result in unintended exposure of sensitive content and compliance/privacy issues.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code sends the YouTube video ID to the transcript API/library without any disclosure or consent mechanism in this file. Even if the identifier seems low sensitivity, it reveals what content a user is processing and may be sensitive in enterprise, research, or private workflow contexts.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 96% confidence
Finding: requests

Known Vulnerable Dependency: markdownify — 2 advisory(ies): CVE-2025-46656 (markdownify allows large headline prefixes such as <h9999999>, which causes memo); CVE-2025-46656 (markdownify allows large headline prefixes such as <h9999999>, which causes memo)

Medium

Category: Supply Chain
Confidence: 85% confidence
Finding: markdownify

Known Vulnerable Dependency: mammoth — 2 advisory(ies): CVE-2025-11849 (Mammoth is vulnerable to Directory Traversal); CVE-2025-11849 (Mammoth is vulnerable to Directory Traversal)

Critical

Category: Supply Chain
Confidence: 95% confidence
Finding: mammoth

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.