Security audit

Markdown转换器免费版

Security checks for vulnerabilities and agentic risk

Overview

This document-conversion skill is mostly purpose-aligned, but it asks agents to run mutable third-party code and cloud/plugin features without enough safety scoping.

Review before installing. Use only with non-sensitive documents unless you pin and trust the converter version, avoid the pipe-to-shell installer, disable plugins, and explicitly approve any Azure or URL-based processing that may send content outside your machine.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:133
Finding: Remote Installer Downloaded and Executed Without Integrity Verification
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 133-135
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
curl -LsSf https://astral.sh/uv/install.sh | sh # Windows: powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

Technical Analysis

The installation instructions retrieve mutable scripts from an external server and immediately execute them through sh or PowerShell iex. Neither command pins an installer version, verifies a cryptographic checksum or publisher signature, nor gives the user an opportunity to inspect the downloaded content before execution.

HTTPS protects the connection in transit but does not guarantee that the delivered script remains identical to the version reviewed during this audit. The effective payload can change whenever the remote installer changes. Compromise of the hosting domain, delivery infrastructure, DNS or TLS trust chain, or upstream release process could therefore turn the documented installation step into arbitrary code execution.

This behavior exceeds the minimum privileges required for document conversion. Converting documents requires a trusted converter and access to designated input and output files; it does not inherently require executing an unverified remote shell script.

Attack Path

An Agent determines that uvx is unavailable and follows the setup instructions.

curl or PowerShell retrieves the current installer from astral.sh.

The response is passed directly to a command interpreter without integrity verification.

A compromised or malicious response executes with the privileges of the user running the Agent.

The payload can access resources available to that user and may download or execute additional components.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. Depending on that ...[truncated 318 chars]
Remediation: View remediation
Remediation Suggestions

Remove all pipe-to-shell and download-to-iex installation instructions.

Prefer a trusted operating-system package manager with package signing and explicit version selection.

If direct installation is unavoidable, download a version-pinned installer as a separate step.

Verify the downloaded artifact against a hard-coded cryptographic checksum and, where available, a publisher signature.

Require explicit user approval before running the verified installer.

Execute installation without administrator privileges unless a documented, necessary operation specifically requires elevation.

Document the files and directories modified by installation and provide a removal procedure.

Pin the expected installer release and review any change before updating the documented hash or signature.

T08 · Insecure Dependencies

Error

Location: SKILL.md:94
Finding: Unpinned Third-Party Package and Optional Plugin Execution
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 94-220
Vulnerability Type: Insecure third-party dependency execution
Risk Level: High

Vulnerable Code

bash
uvx markitdown report.pdf -o report.md uvx markitdown input.pdf uvx markitdown --use-plugins input.docx -o output.md

Technical Analysis

The Skill repeatedly directs the Agent to execute markitdown through uvx without specifying an exact reviewed package version or verified package hashes. Runtime resolution can consequently retrieve and execute dependency content that differs from what was available when the Skill was audited.

The documented --use-plugins option further expands the executable supply-chain boundary by allowing third-party plugin code to run. The instructions do not identify approved plugins, pin plugin versions, verify their integrity, or require isolation.

The Skill's claim that no additional software installation is needed is incomplete from a security perspective: uvx may obtain and run third-party Python package code dynamically. Document conversion legitimately requires parser code, but it does not require trusting mutable package or plugin releases on every invocation.

Attack Path

A user or Agent invokes one of the documented uvx markitdown commands.

uvx resolves an unpinned version of markitdown and its dependency graph.

A compromised, replaced, or unexpectedly changed package version is downloaded and executed.

If plugin mode is enabled, additional unreviewed plugin code may also be loaded.

Malicious dependency code runs with the Agent's local permissions while potentially having access to the source document, output directory, environment variables, cached credentials, and network.

Impact Assessment

Exploitation could provide arbitrary code execution with the invoking user's privileges. A malicious dependency or plugin could read sensitive documents submitted fo ...[truncated 283 chars]
Remediation: View remediation
Remediation Suggestions

Pin markitdown to an exact, reviewed version in every command or through a locked environment.

Lock and verify all transitive dependencies using cryptographic hashes.

Use a trusted package index and prevent fallback to unapproved indexes or dependency sources.

Disable --use-plugins by default.

If plugins are required, maintain an explicit allowlist with exact versions and verified hashes.

Preinstall reviewed dependencies rather than resolving mutable package content during each conversion.

Run the converter in a sandbox or container with no elevated privileges.

Restrict filesystem access to the selected input file and designated output location.

Disable network access during conversion unless a specific documented feature requires it.

Avoid exposing unrelated credentials and sensitive environment variables to the converter process.

Review dependency updates before changing pinned versions or lockfiles.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger keywords are overly broad, including generic terms related to automation, design, images, PDFs, and document generation. This can cause unintended activation of a skill that has exec capability, meaning routine user requests may unexpectedly invoke external tooling or networked behaviors.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The | sh pattern explicitly chains network retrieval into immediate shell execution, turning a documentation step into a one-line arbitrary code execution path. Within an agent or developer environment, this can fully compromise the host, steal credentials, alter files, or establish persistence if the fetched content is malicious.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
...

如未安装,安装uv

macOS/Linux:

curl -LsSf https://astral.sh/uv/install.sh | sh

Windows:

powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

text

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill recommends Azure Document Intelligence for better PDF conversion but does not warn that document contents may be transmitted to an external cloud service. That omission is dangerous because users may process sensitive documents under the assumption that conversion remains local, leading to confidentiality and compliance violations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill advertises handling of YouTube URLs and Azure Document Intelligence, introducing network-capable behavior beyond a simple local converter. This expands the attack surface and data-exposure risk because inputs may be fetched from remote services or sent to cloud endpoints without strong scoping or disclosure controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The claimed capability coverage uses a long, ambiguous keyword list that is not a well-bounded activation scope. In practice this increases the chance that the agent selects this skill for loosely related tasks, expanding exposure to command execution and external dependency usage without clear user intent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill repeatedly instructs the agent to execute uvx markitdown without pinning an exact package/version, which allows the resolved code to change over time and potentially pull a malicious or compromised release. In an agent context with exec enabled, this is a supply-chain execution risk because the agent may run whatever code the package registry serves at invocation time.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This command uses uvx markitdown without version pinning, so execution depends on the latest available package state rather than a reviewed immutable artifact. That creates a supply-chain risk where a compromised upstream package or dependency can execute arbitrary code when the skill is used.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: An unpinned uvx markitdown invocation means the executed converter code is not stable or reviewable across runs. Because this skill is designed for command execution, a malicious package update could directly gain code execution in the agent environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill tells users or agents to run uvx markitdown without fixing the package version, exposing them to silent upstream changes. In practice this converts documentation into a code-execution pathway for whatever version the resolver fetches at runtime.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Because the invocation is unpinned, the skill can execute different code at different times despite identical user input. That is dangerous in an automated agent setting where package-resolution decisions are effectively trusted code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This example again relies on uvx markitdown without an explicit version, making the runtime behavior dependent on the latest package state. If the package or one of its dependencies is compromised, the skill can become an arbitrary code execution vector.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The command is vulnerable to package substitution or malicious update issues because no exact version is pinned. In a skill that exposes exec, even a documentation example can steer the agent into running unreviewed code from the network.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Unpinned uvx usage means the fetched executable code can drift over time and differ from what the skill author tested. That creates a real supply-chain risk, especially because the skill's purpose is to invoke external tooling rather than perform a purely declarative action.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The quick-start command executes an unpinned package, which is a classic supply-chain weakness when package registries are involved. Since users are encouraged to run it directly, exploitation would require only a malicious upstream release or dependency compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The documented CLI syntax omits version pinning, normalizing unsafe package execution for all later examples. In an agent ecosystem, this broadens exposure because the skill may be invoked automatically and repeatedly with mutable upstream code.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Documenting --use-plugins introduces execution of third-party extension code that is not necessary for the stated basic conversion purpose. In an agent with exec, plugin loading materially increases arbitrary code execution and supply-chain risk because unreviewed plugins can run with the same privileges as the converter.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This example executes uvx markitdown directly and therefore trusts the registry's current package resolution. The danger is heightened by the skill's exec capability: a compromised package update becomes immediate code execution during routine document conversion.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Because no version is pinned, the behavior and code provenance of markitdown are not fixed. That is a true vulnerability in a skill document whose primary operation is to cause tool execution from package-managed sources.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This unpinned invocation inherits the same supply-chain execution weakness as the other examples. A malicious update could exfiltrate document contents, execute arbitrary commands, or persist in the environment under the guise of conversion.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill treats external package execution as routine but does not constrain what code is actually fetched and run. That makes this a real vulnerability rather than a theoretical issue, because the package is resolved at runtime from mutable infrastructure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Again, the command relies on unpinned package resolution, enabling silent code changes outside the author's control. In a document-processing skill, this could expose sensitive input files to arbitrary malicious code introduced through the supply chain.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The standard-input example still runs an unpinned external package, so all data piped into it is exposed to code whose provenance is not fixed. This is especially risky because stdin workflows often handle ad hoc or sensitive content in automated pipelines.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The optimization example continues the pattern of executing unpinned package code. Because the example may be copied into production workflows, it creates a durable path for supply-chain compromise and arbitrary code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This example compounds risk by combining unpinned package execution with potentially sensitive document handling. A malicious package release could tamper with outputs or leak source files while appearing to perform normal conversion.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The plugin-related example still executes an unpinned package from a mutable source, which undermines code trust even before plugin-specific concerns are considered. Any compromise of the main package or dependencies can execute with the agent's privileges.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Vague Triggers

Chaining Abuse

...

如未安装,安装uv

macOS/Linux:

Windows:

Missing User Warnings

Context-Inappropriate Capability

Vague Triggers

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Context-Inappropriate Capability

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Static analysis