Excel To Markdown

• Outcome: Pass
• Latest audit: May 29, 2026, 8:28 PM
• Version:
  1.0.0

Overview

This skill is a disclosed cloud-backed office-document converter, with privacy considerations but no artifact-backed malicious or Review-level behavior.

Install only if you are comfortable installing the MinerU CLI and sending selected office documents or document URLs to MinerU for processing. Avoid confidential, regulated, or local-only files unless the user has permission and understands the upload.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The skill declares very broad activation cues such as "read", "extract", and "convert" without requiring stronger file-type or document-specific qualifiers. This can cause the skill to be invoked for generic user requests, increasing the chance of unintended document upload to a third-party cloud service and unexpected handling of sensitive files.

VirusTotal

66/66 vendors flagged this skill as clean.