Markdown 工具箱

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 1.0.1

Overview

This is a Markdown helper with disclosed file and command-line linting support, and I found no hidden exfiltration, persistence, or destructive behavior.

Install only if you want a Markdown authoring and linting helper. Keep its use scoped to user-designated Markdown files, approve any shell commands explicitly, and prefer a pinned project-local markdownlint dependency over the suggested global npm install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:235

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 235
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Vulnerable Code

markdown

| markdownlint | Validation tool | Recommended | `npm install -g markdownlint-cli` |

The original dependency table recommends executing npm install -g markdownlint-cli without specifying an audited version, lockfile, or package integrity value.

Technical Analysis

The installation command resolves the package version from the npm registry at execution time. Consequently, the installed artifact can differ from the artifact that existed when the Skill was reviewed. npm installation may also execute package lifecycle scripts with the permissions of the invoking user.

The global installation flag modifies the user's or system's shared npm environment rather than isolating the dependency within the project. This expands the effect of a compromised, malicious, or unexpectedly changed package release beyond the audited Skill.

The reviewed project does not itself contain a malicious script, retrieve a remote executable payload directly, or prove that markdownlint-cli is malicious. The risk arises from the unsafe dependency installation guidance.

Attack Path

1. An attacker compromises the referenced package, one of its transitive dependencies, or the relevant package publishing account.
2. The attacker publishes a malicious release containing harmful package code or an installation lifecycle script.
3. A user or agent follows the Skill's recommendation and runs npm install -g markdownlint-cli.
4. npm resolves the current registry release because no version or integrity constraint is provided.
5. Malicious lifecycle code executes with the permissions of the user running npm, and the package is placed in the shared global npm environment.

Impact Assessment

Successful exploitation could execute arbitrary cod ...[truncated 471 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific reviewed version, for example by declaring an exact version in package.json.
2. Install it as a project-local development dependency rather than globally:

   bash

   npm install --save-dev --save-exact markdownlint-cli@<reviewed-version>
   

3. Commit and enforce a lockfile, then use npm ci in automated environments to obtain deterministic dependency resolution.
4. Verify package provenance, maintainers, release history, and transitive dependencies before approving a version.
5. Use npm integrity and provenance controls where supported, and regularly audit the locked dependency tree.
6. Consider --ignore-scripts when package lifecycle scripts are unnecessary and compatibility has been verified.
7. Run validation in a restricted environment with minimal filesystem, credential, and network access.
8. Do not run dependency installation with administrator or root privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

表格进阶

echo "操作完成"

markdown

<!-- 对齐控制 -->
| 左对齐 | 居中 | 右对齐 |
|:---:|:---:|:---:|
| A      |  B   |      C |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

表格进阶

echo "操作完成"

markdown

<!-- 对齐控制 -->
| 左对齐 | 居中 | 右对齐 |
|:---:|:---:|:---:|
| A      |  B   |      C |

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is presented as a Markdown generation/validation toolkit, but it requests read/exec/write capabilities without clearly constraining how shell execution will be used. This broadens the attack surface because a user may invoke a seemingly harmless documentation tool that can also run commands and modify files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises exec and write capabilities without prominent warnings about shell execution, filesystem changes, or the need for user approval. In agent environments, insufficient disclosure makes risky actions more likely to occur under the guise of a benign document-generation task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Arbitrary command execution is not justified by the stated purpose of producing portable Markdown. A skill with exec access but no clear execution boundaries can be repurposed to run unintended shell commands, creating risk of local command execution and side effects unrelated to Markdown processing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough to cover generic coding, debugging, testing, and deployment scenarios, far beyond a Markdown toolkit's stated scope. Overbroad activation increases the chance that the skill is invoked in inappropriate contexts where its exec/write permissions could be misused.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The documentation claims the tool is a pure Markdown instruction skill with no extra API key requirements, yet other sections describe command execution and network-dependent operation. This mismatch can mislead users and reviewers about the actual privileges and runtime behavior of the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The troubleshooting guidance introduces ping/network testing behavior even though the skill is described primarily as a Markdown instruction tool. This inconsistency can normalize unnecessary network command execution and could prompt agents to perform outbound connectivity checks that are outside the tool's core purpose.

Content

No source excerpt is available for this finding.