Baoyu Format Markdow

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 1.0.1

Overview

The skill is a markdown formatter, but it can run an unpinned package through npx and references missing local scripts, so users should review it before installing.

Install only if you are comfortable with a formatter that can write files, optionally edit the original markdown file, read local preference files, and run a shell command. Prefer using it only with a preinstalled trusted bun runtime, avoid the npx fallback, and verify or add the missing scripts before relying on the typography step.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34

Finding

Unpinned Package Download and Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 34
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

markdown

Scripts in `scripts/` subdirectory. `{baseDir}` = this SKILL.md's directory path. Resolve `${BUN_X}` runtime: if `bun` installed → `bun`; if `npx` available → `npx -y bun`; else suggest installing bun. Replace `{baseDir}` and `${BUN_X}` with actual values.

The resolved command is subsequently used at line 289:

bash

${BUN_X} {baseDir}/scripts/main.ts {output-file-path} [options]

Technical Analysis

The Skill directs the Agent to use npx -y bun when Bun is not already installed. This command automatically resolves a package from the configured npm registry, downloads it, and executes it without interactive confirmation.

No exact package version or integrity digest is specified. Consequently, the code executed at runtime is not fixed to the artifact that was audited and may change independently after review. This creates an insecure software supply-chain boundary: compromise of the package, registry account, registry configuration, or dependency resolution process could cause attacker-controlled code to run.

The repository contains only SKILL.md; the referenced local scripts are absent. That packaging defect does not itself prove malicious behavior, but it prevents verification of the intended typography implementation and may cause the command to fail after the runtime package has already been downloaded or invoked.

Attack Path

1. A user invokes the Skill's formatting workflow on a system where bun is not installed but npx is available.
2. Following line 34, the Agent resolves ${BUN_X} to npx -y bun.
3. During the typography stage described at line 289, npx contacts the configured npm registry and resolves the current, unpinned bun package.
4. The package and its dependency graph are downloaded without an interactive approval prompt.
5. Pack ...[truncated 939 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the automatic npx -y bun fallback and require a trusted, preinstalled Bun runtime.
2. If runtime installation is necessary, pin Bun to an explicitly reviewed version rather than resolving the latest package.
3. Verify downloaded artifacts using a trusted checksum, signature, or lockfile with integrity metadata.
4. Use a trusted registry and fail closed if the required version or integrity verification is unavailable.
5. Require explicit user approval before downloading or executing any third-party runtime.
6. Execute the formatter with least privilege in a restricted environment that limits filesystem, credential, and network access.
7. Include the referenced scripts/main.ts and related files in the package so their behavior can be audited.
8. Add automated release checks that reject missing referenced files and unpinned executable dependencies.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description lists activation keywords like "files", "format", "text", "plain", and "markdown", which are generic terms likely to appear in many unrelated user requests. Without tighter scope, exclusions, or context constraints, this skill could be invoked unintentionally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

A markdown-formatting skill declares Bash access and later instructs shell execution for formatting tasks. In this context, shell capability is broader than necessary for a formatter and increases blast radius if the skill is invoked on untrusted paths, manipulated configs, or compromised helper scripts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The overview says the goal is formatting without changing original content, and the core principle explicitly says to never add, delete, or rewrite content. Later steps instruct the agent to create frontmatter fields like title, summary, and description and to save a separate analysis document, which goes beyond pure formatting and adds new authored content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description understates side effects even though the workflow can write multiple files and, in one mode, modify the original file in place. For a tool with Write, Edit, and Bash capabilities, poor disclosure is dangerous because users may authorize execution without understanding that original data can be changed or additional files created.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The core principle forbids adding, deleting, or rewriting content, but later sections direct the agent to generate title/summary/description text and to remove an H1 from the document body after extracting it to frontmatter. That is an active contradiction in the skill's own instructions, not merely an omitted detail.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The skill instructs the agent to resolve and execute ${BUN_X} as npx -y bun when bun is not installed, which fetches and runs a package without a pinned version. That creates a supply-chain risk: behavior may change over time, and a compromised or malicious upstream package/version could lead to arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill again advertises trigger keywords including generic words like "files", "format", and "text". This lacks specificity and does not define boundaries for when the skill should activate versus when those common words should be ignored.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The documentation says the skill "主要支持中英文内容" and that formatting for other languages may be suboptimal. While framed as a limitation, it does not offer users a language choice or an explicit opt-in path, which may conflict with language/locale neutrality expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.