Security audit

Md2mindmap

Security checks for vulnerabilities and agentic risk

Overview

This Markdown mind-map skill does what it claims, but its generated files load third-party browser code by default without clear user-facing disclosure.

Review before installing if you plan to convert private or sensitive Markdown. The tool appears purpose-built rather than malicious, but generated HTML fetches and runs third-party code from unpkg.com, and PDF export uses Playwright/Chromium. Prefer using it in an isolated environment, avoid sensitive documents unless dependencies are bundled locally or network access is blocked, and pin/install dependencies from trusted sources.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:76
Finding: Unpinned Playwright and Chromium Dependencies
Content: View full analysis
Remediation: View remediation
\ --hash=sha256: ``` 2. Install dependencies with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Pin and verify the corresponding Chromium revision. Where practical, distribute an approved browser through a controlled artifact repository and validate its checksum before use. 4. Document the trusted package index and disable unexpected additional indexes to reduce dependency-confusion exposure. 5. Run dependency installation and PDF generation in an isolated, non-privileged environment with limited filesystem and network access. 6. Add automated dependency auditing and reproducibility checks to ensure that published releases use the reviewed package and browser versions. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

Location: markmap_generator.py:299
Finding: Generated Documents Retrieve and Execute Remote JavaScript Without Integrity Verification
Content: View full analysis
``` The same remote resource references are present in the committed generated examples, including `test.html` and `empty.html`. ### Technical Analysis Every generated mind-map document loads and executes JavaScript directly from `unpkg.com`. Although package versions appear in the URLs, the resources are not protected by Subresource Integrity hashes and are not bundled as reviewed local assets. The effective code executed when a document is opened can therefore differ from the code reviewed with this project if the CDN, package publication account, package contents, or delivery path is compromised. The generated page also lacks a restrictive Content Security Policy. This behavior occurs both when a user opens generated HTML interactively and when `generate_pdf_from_html()` opens that HTML in Chromium for PDF production. It creates an external network dependency and exposes the rendered document to third-party code. ### Attack Path 1. A user converts a Markdown document, potentially containing confidential business or personal information. 2. The generator embeds external script URLs in the output HTML. 3. The user opens the HTML, or the application opens it in Playwright to generate a PDF. 4. The browser retrieves JavaScript from `unpkg.com` at runtime. 5. An attacker who has compromised the CDN, package release, or delivery path serves modified JavaScript. 6. The modified ...[truncated 903 chars]
Remediation: View remediation
/asset.js" integrity="sha384-" crossorigin="anonymous"> ``` 4. Add a restrictive Content Security Policy. After moving resources locally, prefer a policy similar to: ```html ``` 5. Avoid inline scripts or authorize only fixed inline content through CSP hashes rather than enabling unrestricted `'unsafe-inline'`. 6. Generate PDFs with outbound network access disabled after all required assets have been bundled locally. 7. Add a regression test that rejects generated HTML containing remote script or stylesheet references. 8. Clearly disclose any unavoidable network access and warn users not to process sensitive documents while third-party runtime resources remain enabled. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The title "小技验收报告" and the entire document are written in Chinese with no indication that another language is supported or that Chinese is required for a documented regional/compliance reason. This can violate a language/locale policy when users are not given an opt-in or alternative language.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises executable behavior that reads input files and writes HTML/PDF outputs, but it does not declare any tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it harder for a host agent or user to understand and constrain filesystem access before execution.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated HTML loads JavaScript and CSS from third-party CDNs at runtime, so a supposedly local markdown-to-mindmap conversion produces output that depends on remote code execution in the browser. This creates supply-chain and privacy risks: a compromised CDN, dependency drift, or network interception could alter the rendered page or expose document access patterns when the HTML is opened.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The HTML loads JavaScript and CSS from third-party CDNs at runtime, which introduces unnecessary network access and a supply-chain trust dependency for what appears to be a local markdown-to-mindmap rendering task. If a CDN response is tampered with, unavailable, or replaced, the page could execute untrusted code in the viewer's browser.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file’s user-facing instructions and descriptions are written exclusively in Chinese, including installation and usage guidance. Under the policy for natural-language constraints, this can be a locale/language restriction unless the skill offers an opt-in choice or explicitly states that it is intended for a Chinese-only audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill documents PDF generation through Playwright/Chromium without clearly warning that it launches browser automation components and writes generated files to disk. While this is common functionality, lack of disclosure can surprise users and reduce informed consent around execution side effects and dependency behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This Python file contains natural-language instructions and descriptions only in Chinese, including the module docstring and later CLI help/output strings. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The skill's purpose is markdown-to-mindmap conversion with HTML/PDF output, but the implementation uses Playwright to launch Chromium and render HTML. While functional, spawning a full browser is a broader capability than the manifest description suggests and can execute whatever the generated page loads, including remote scripts referenced by that page.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The title and rendered mindmap content are written in Chinese, and the file does not indicate that this is a locale-specific skill or offer any language selection. That can violate the language/locale policy criterion because it forces a specific language without user opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The page silently performs external network fetches for scripts and styles without any user-facing notice. This reduces transparency and can surprise users in environments expecting offline/local-only processing, increasing privacy and trust risks even if the loaded resources are not directly malicious.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The markdown content is entirely in Chinese and does not indicate that language choice is optional or justified by a region-specific purpose. Under the language/locale policy, a skill should not implicitly force a specific language unless it offers user choice or clearly documents the constraint.
Content: No source excerpt is available for this finding.