Markdown导出工具(免费版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:39 AM UTC
• Version: 1.0.1

Overview

This markdown export skill appears purpose-aligned, but it asks the agent to install and run an unpinned third-party command-line package and includes under-scoped file/network handling guidance.

Review this skill before installing. Use it only in an isolated, least-privileged environment, pin and verify the `md-exporter` package before installing, avoid fixed shared temporary paths, and do not provide a callback URL unless you explicitly trust the destination and know what content will be sent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:127

Finding

Unpinned and Unaudited Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 127
Vulnerability Type: Supply-chain risk from an unpinned third-party package
Risk Level: Medium

Vulnerable Code

markdown

1. 安装：`pip install md-exporter`

Technical Analysis

The Skill instructs the Agent to install md-exporter from pip's configured package index without specifying an exact version, verifying a cryptographic hash, or identifying a trusted source repository.

A Python package can execute package-controlled build or installation logic. The installed package also supplies the markdown-exporter executable used throughout the Skill. Because the package implementation is not included in the audited project, neither its conversion behavior nor its side effects can be verified from the available source.

This creates a mutable supply-chain trust boundary: future executions can resolve package content that differs from what the Skill author originally tested. Exploitation would require the package, one of its transitive dependencies, or the configured package index to be compromised, replaced, or otherwise attacker-controlled. The audit did not establish that the current package is malicious.

Attack Path

1. An attacker compromises the md-exporter package, a transitive dependency, or the package source used by the Agent.
2. The Agent follows the Skill instruction and runs pip install md-exporter.
3. Pip resolves and installs attacker-controlled or unexpectedly modified content.
4. Package-controlled installation logic or the installed executable runs with the Agent's operating-system privileges.
5. Malicious code can access files, credentials, network resources, and output locations available to that account, including Markdown documents supplied for conversion.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the privileges of the account running pip or invoking markdown-exporter. The accessible scope would ...[truncated 365 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin md-exporter to a reviewed, exact version rather than using an unconstrained package name.
2. Use a lock file with cryptographic hashes and install with pip's --require-hashes option.
3. Document the authoritative source repository and verify package provenance or signatures where supported.
4. Review and lock all transitive dependencies.
5. Prefer including or vendoring the reviewed implementation so its effective behavior is part of the audit scope.
6. Install and execute the converter in an isolated, least-privileged environment with only required input and output directories mounted.
7. Disable unnecessary network access while processing documents.
8. Avoid running pip or the converter as an administrator or root user.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:152

Finding

Predictable Shared Temporary Files Permit Symlink and Collision Attacks

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 152
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Medium

Vulnerable Code

markdown

设计上要求所有输入为文件路径，确保大文件处理的稳定性和可重现性。如果需要处理管道输入的Markdown文本，先写入临时文件再调用命令：`echo "$markdown" > /tmp/input.md && markdown-exporter md_to_docx /tmp/input.md /tmp/output.docx`.

Technical Analysis

The documented command writes input and output through fixed, predictable paths in the shared /tmp directory:

bash

echo "$markdown" > /tmp/input.md &&
markdown-exporter md_to_docx /tmp/input.md /tmp/output.docx

Fixed names allow concurrent executions to overwrite or consume one another's files. In a multi-user environment, another local process may pre-create either path, including as a symbolic link. The shell redirection to /tmp/input.md can then follow that link and overwrite its target with the privileges of the Agent. Depending on how the external converter creates its output, /tmp/output.docx may present a similar link-following or overwrite risk.

The input file may also remain after execution and contain sensitive Markdown in a shared temporary location. The exact disclosure risk depends on the process umask, directory permissions, cleanup behavior, and converter implementation.

Attack Path

1. A local attacker predicts the documented paths /tmp/input.md and /tmp/output.docx.
2. Before Skill execution, the attacker creates one of those paths as a symbolic link to a file writable by the Agent, or creates a conflicting regular file.
3. The Agent executes the documented command.
4. Shell redirection follows /tmp/input.md and may overwrite the attacker-selected target. Alternatively, concurrent operations replace or disclose another invocation's input.
5. If the converter follows a pre-created output link, it may write generated content to an unintended target.
6. Any temporary files left behind may expose document content to users or processes able to read them.

...[truncated 564 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a unique private temporary directory:

bash

tmp_dir="$(mktemp -d)" || exit 1
chmod 700 "$tmp_dir"
trap 'rm -rf -- "$tmp_dir"' EXIT HUP INT TERM

input_file="$tmp_dir/input.md"
output_file="$tmp_dir/output.docx"

printf '%s' "$markdown" > "$input_file" &&
markdown-exporter md_to_docx "$input_file" "$output_file"

2. Use printf '%s' rather than echo to preserve input reliably and avoid option or escape interpretation differences.
3. Keep all generated paths inside the private directory and quote every path expansion.
4. Verify that input and output paths are regular files and not symbolic links where files may be attacker-controlled.
5. Move the completed output to its final destination only after successful conversion and validation.
6. Apply restrictive permissions and ensure cleanup occurs on both success and failure.
7. Run document conversion under a dedicated, unprivileged account when processing untrusted content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description claims broad applicability for unspecified 'related development scenarios' without clear trigger boundaries, which can cause an agent to invoke the skill in contexts beyond simple markdown export. In a skill that exposes read, write, and exec tools, vague scope increases the chance of inappropriate execution or file handling on untrusted inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises a callback_url parameter for asynchronous completion but provides no warning, validation guidance, or restrictions on sending data to external endpoints. In combination with document conversion workflows, this can enable exfiltration of sensitive content or SSRF-style requests if an agent posts results or metadata to attacker-controlled URLs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.