Security audit
Security checks for vulnerabilities and agentic risk
This Markdown conversion skill is mostly local, but it includes unexplained API, callback, and credential instructions that do not fit the stated exporter purpose.
Use this only for local Markdown conversion. Do not provide API keys, tokens, callback URLs, or sensitive documents unless the publisher clarifies why network/API access is needed and exactly what data leaves the machine.
The documentation introduces API credential setup, connection initialization, and interface calling behavior that conflicts with the rest of the skill, which presents a local file-based Markdown conversion tool. This mismatch can mislead an agent or user into supplying secrets or enabling unnecessary network behavior, expanding the trust boundary without clear justification.
The feature list claims API integration and information retrieval capabilities that are not supported by the documented Markdown exporter workflow. Overstating capabilities can cause an agent to invoke unnecessary tools, fetch external data, or expose local content under the false assumption that such behavior is intended.
The description uses very broad invocation language such as improving efficiency, automation, batch processing, and workflow optimization, which can match many unrelated user requests. This increases the chance that an agent will select the skill outside its safe scope, leading to unnecessary file access or command execution for tasks that do not actually require a Markdown exporter.
The skill defines a callback_url parameter and elsewhere references API-style behavior without clearly warning that data may be transmitted to external endpoints. This can lead users or agents to send document contents or metadata off-host without informed consent, creating confidentiality and compliance risks.
No suspicious patterns detected.
