ClawHub
Back to skill

Security audit

Markdown Converter

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Markdown conversion helper, but users should understand that it runs a third-party command through uvx at runtime.

Install only if you are comfortable letting Codex run `uvx markitdown` on files you choose. For sensitive documents, prefer a pinned/reviewed markitdown version or a sandboxed environment with limited file, credential, and network access.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned Third-Party Package Download and Execution Through uvx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–19
Vulnerability Type: Unpinned runtime dependency execution
Risk Level: Medium

Vulnerable Code

markdown
Convert files to Markdown using `uvx markitdown` — no installation required.

## Basic Usage

```bash
# Convert to stdout
uvx markitdown input.pdf

# Save to file
uvx markitdown input.pdf -o output.md
uvx markitdown input.docx > output.md
text

### Technical Analysis

The Skill instructs users or agents to invoke `markitdown` through `uvx` without specifying an exact package version, lockfile, dependency hashes, or trusted package-index policy. `uvx` can resolve, download, cache, and execute the requested package and its transitive dependencies at runtime.

Consequently, the executable dependency set is mutable and may differ between invocations. If a future package release, transitive dependency, or package-index artifact is compromised, following these instructions could execute attacker-controlled code. The statement that no installation is required may also obscure the fact that third-party executable content can be downloaded and cached.

This finding concerns supply-chain integrity. The audited file contains no evidence that the current `markitdown` package is malicious.

### Attack Path

1. A user or agent follows the Skill and runs `uvx markitdown` against a document.
2. `uvx` resolves the current package version and its transitive dependencies from a configured package index.
3. An attacker compromises a package release, transitive dependency, maintainer account, or package-index artifact.
4. `uvx` downloads and executes the compromised component without validation against a reviewed lockfile or expected hashes.
5. Malicious installation or runtime code executes with the permissions and environment access of the invoking process.

### Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The resulting 
...[truncated 686 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin markitdown to an exact, reviewed version rather than resolving the latest available release at execution time.
  2. Use a committed lockfile that fixes all transitive dependency versions.
  3. Require cryptographic hashes for downloaded distributions where the selected tooling supports hash verification.
  4. Restrict dependency resolution to an explicitly configured and trusted package index; do not permit fallback to unintended indexes.
  5. Review and update pinned dependencies through a controlled process that includes security scanning and changelog inspection.
  6. Execute conversion in a sandbox or container with:
    • Read-only access to the input document where practical.
    • Write access limited to the intended output directory.
    • No unnecessary credentials or sensitive environment variables.
    • Restricted outbound network access.
    • No administrative privileges.
  7. Update the documentation to state clearly that uvx may download, cache, and execute third-party packages and dependencies.
  8. Consider distributing a reviewed, reproducible environment or prebuilt artifact whose provenance and integrity can be verified before execution.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.