Markdown转PDF（免费版）

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.2

Overview

This skill is a Markdown-to-PDF helper whose file and command access fit its document conversion purpose, with some documentation and dependency hygiene issues users should notice.

Install only if you are comfortable with a skill that can read Markdown files, write PDF outputs, and run local pandoc/xelatex commands. Avoid running broad or ambiguous conversion requests, choose output locations explicitly, and consider skipping the unused `pip install requests` step or using an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:137

Finding

Unnecessary and Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 137
Vulnerability Type: Unverified third-party package installation
Risk Level: Low

bash

pip install requests

Technical Analysis

The setup instructions direct the Agent to install requests without specifying an audited version, verifying package hashes, or constraining the package index. The documented conversion implementation only imports the Python standard-library subprocess module and does not use requests, making this an unnecessary dependency.

An unconstrained pip install resolves the package and its transitive dependencies from the environment's configured package index. If that index, a package release, or the dependency resolution path is compromised, installation may introduce attacker-controlled code. Source distributions and malicious build dependencies may execute code during package installation.

Attack Path

1. A user or Agent follows the environment preparation instructions.
2. The Agent executes pip install requests.
3. pip consults the environment's configured package index without enforcing a version or cryptographic hashes.
4. An attacker who controls or has compromised the selected package source, package release, or resolution path supplies a malicious distribution or build dependency.
5. Attacker-controlled code executes during installation or is installed for later execution.

This path requires compromise or manipulation of the configured package supply chain; the audited file does not itself identify or retrieve a malicious package.

Impact Assessment

Successful exploitation could execute code with the privileges of the account running pip. This may permit access to files, environment variables, credentials, and network resources available to that account. System-wide impact is possible if installation is performed by an administrator, although the Skill does not request elevated privileges. Th ...[truncated 93 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove pip install requests, because the documented implementation does not import or use that package.
2. If future functionality requires it, declare the dependency in a reviewed lock file with an exact version and cryptographic hashes.
3. Install dependencies only from an explicitly trusted package index.
4. Use an isolated virtual environment rather than the system Python environment.
5. Prefer binary wheels from trusted publishers and disable unneeded source builds.
6. Run dependency vulnerability and provenance checks as part of the release process.
7. Never perform package installation with administrator privileges unless it is strictly required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The summary explicitly advertises "批量转换" as a supported capability for the free version, which is reinforced again in the usage scenarios. However, later documentation states the free edition supports only single-task or single-operation use, creating a direct contradiction about whether batch conversion is available.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill declares read, write, and exec tool access without a prominent warning about filesystem modification and command execution. In an agent environment, this can normalize powerful actions and lead users to invoke the skill without understanding that local files may be created or external commands like pandoc/xelatex may run.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are generic enough to overlap with ordinary user requests, increasing the chance this skill activates when a user did not explicitly intend to invoke it. Because the skill advertises write and exec capabilities, accidental activation could cause file conversion, file creation, or local command execution in contexts broader than expected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill name, summary, description, examples, and user-facing guidance are entirely presented in Chinese, and the example implementation hardcodes a Chinese font (SimSun) for output generation. Because no language-choice or opt-in is offered, the file appears to enforce a specific language/locale for all users.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file says the skill requires no additional API key, but immediately above that it lists an LLM API as a required dependency. Even if the API is platform-provided, the wording creates an intent-level contradiction about whether an external API dependency is necessary.

Content

No source excerpt is available for this finding.