文档导出工具免费版

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:26 AM UTC
• Version: 1.0.3

Overview

This skill is a local Markdown conversion guide with expected file-write and command-line behavior, but users should review dependency installation and output paths before use.

Install only in a trusted or isolated environment, pin or verify the md-exporter package where possible, review commands before running them, choose output paths deliberately, and do not allow privileged font installation unless you intentionally approve it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:93

Finding

Unpinned Third-Party Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 93–96; dependency instruction repeated at line 302
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable code:

bash

pip install md-exporter
# ...
# Or install through uv
uv tool install md-exporter

The dependency table repeats the installation instruction:

markdown

| md-exporter | Python package | Required | `pip install md-exporter` |

Technical Analysis

The Skill instructs the Agent to install and execute the md-exporter package without specifying an exact version, verifying package hashes, identifying a trusted publisher or repository, or using a lock file. Package names alone resolve to mutable artifacts from the configured Python package index.

Consequently, the code reviewed during one installation may differ from the package retrieved later. If the package, publisher account, registry, or dependency chain is compromised, installation hooks or the subsequently invoked markdown-exporter executable could run attacker-controlled code. The project contains no local implementation that would allow the installed package's behavior to be independently audited.

This finding identifies an unsafe supply-chain configuration; the available evidence does not establish that the current md-exporter package is malicious.

Attack Path

1. An attacker publishes or introduces a malicious release through compromise of the package, publisher account, registry, or transitive dependency chain.
2. An Agent follows SKILL.md and runs pip install md-exporter or uv tool install md-exporter.
3. The package manager resolves the mutable package name to the attacker-controlled release because no exact version or integrity hash is required.
4. Package-controlled code executes during installation or when the Agent invokes the documented markdown-exporter commands.
5. The malicious code opera ...[truncated 796 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin md-exporter to an exact, independently reviewed version rather than installing the latest available release.
2. Use a hash-locked requirements file or equivalent lock mechanism, such as:

   text

   md-exporter==REVIEWED_VERSION \
       --hash=sha256:VERIFIED_DISTRIBUTION_HASH
   

3. Document the package's canonical repository, expected publisher, and verification process.
4. Review and lock all transitive dependencies, not only the top-level package.
5. Retrieve packages from a trusted, controlled index or an internally mirrored artifact repository.
6. Run installation and document conversion in an isolated environment with least-privilege filesystem access and restricted network access.
7. Prevent the converter from accessing credentials, unrelated user files, and sensitive environment variables.
8. Add automated dependency provenance, integrity, and vulnerability checks before approving package updates.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill repeatedly instructs the agent to export and save files using write-capable tooling, but it does not warn about overwriting existing paths or modifying user files. In agentic execution, omission of overwrite safeguards can cause destructive file replacement or unintended writes to sensitive locations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill defines its activation scope with very broad, generic keywords around file handling, conversion, and content extraction. In an agent environment, that can cause over-triggering on unrelated user requests, leading the agent to invoke exec/write-capable behavior in contexts the user did not specifically intend.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill includes a command using sudo to install system packages. In an agent context with exec access, privileged command examples materially increase risk because a user or automation layer may execute them without adequate review, resulting in system-wide changes and elevated-impact mistakes.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

bash

# Ubuntu/Debian
sudo apt-get install fonts-noto-cjk
# ...
# macOS
brew install --cask font-noto-sans-cjk

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Lines L307-L308 explicitly state the free edition is fully local and does not involve any cloud service calls. However, L320 documents a '网络错误' case and tells the user to run ping and check firewall/proxy settings, which contradicts the stated local-only, no-network design rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The display name, summary, and most instructions are presented in Chinese, which can effectively force a language choice for users if this skill is broadly distributed. There is no explicit opt-in, bilingual guidance, or statement that the skill is intended only for a Chinese-language audience.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

L040 says all commands only support file paths as input, and L264 repeats that stdin input is unsupported. But L163-L164 documents a mode that emits HTML text to stdout instead of performing a file-path-to-file-path conversion, which conflicts with the earlier characterization of the interface.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.