Security audit

Markdown编辑工具

Security checks across malware telemetry and agentic risk

Overview

This Markdown helper mostly matches its stated purpose, but it asks for broad file-writing and command-execution powers without enough limits.

Review this skill before installing. It may be acceptable if your agent constrains it to specific Markdown files and known formatting or linting commands, but avoid granting unrestricted shell access or API-key/network use for ordinary Markdown cleanup.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The manifest positions the skill as a Markdown formatting tool, but it also exposes read, write, and exec capabilities that materially exceed that purpose. This creates a deceptive capability boundary: a caller may invoke or approve the skill expecting text transformation, while the skill can modify files and execute commands, increasing the risk of prompt-driven misuse or unauthorized side effects.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Command execution is not justified by the stated Markdown-editing purpose and substantially expands the attack surface. If an agent passes user-controlled content into shell commands or uses exec as part of the workflow, this can lead to arbitrary command execution, data loss, or environmental compromise.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The documentation introduces external API usage and network-dependent behavior without a clear Markdown-specific necessity. Unnecessary network capability can expose content to third parties, create data exfiltration paths, and weaken the trust boundary for a skill that users expect to operate locally on documents.

Intent-Code Divergence

Medium

Confidence: 76% confidence
Finding: The documentation frames the skill narrowly in some sections but later advertises broader file handling, API integration, and command execution behavior. This inconsistency can mislead users and higher-level agents about the skill's actual authority, making risky actions more likely to be approved or invoked without adequate scrutiny.

Vague Triggers

Medium

Confidence: 74% confidence
Finding: The skill description is broad and underspecified, lacking clear constraints on what inputs, outputs, and operations are permitted. In agent environments, vague specifications increase the chance of over-broad invocation, unsafe tool selection, and unintended handling of sensitive files or content.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises file writing and command execution without prominent warning about side effects, permissions, or risks. This undermines informed consent and can cause users or orchestrators to trigger destructive actions under the assumption that the skill only reformats Markdown.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.