Pandoc转换工具（免费版）

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.2

Overview

This is a document-conversion skill that uses Pandoc locally; its main risks are unclear documentation and an unnecessary dependency install, not evidence of malicious behavior.

Install only if you are comfortable with a skill that runs local Pandoc commands and writes converted files. Avoid running it on untrusted documents, check output paths before conversion, and consider removing the unused requests install step or using an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:135

Finding

Unnecessary and Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 135–139
Vulnerability Type: Unpinned and unnecessary dependency installation
Risk Level: Medium

Vulnerable Code:

bash

# Ensure Python is available
python3 --version
# ...
# Dependency notes
pip install requests

Technical Analysis

The skill instructs the agent or user to install the latest version of the third-party requests package without specifying a reviewed version, validating an integrity hash, or requiring a trusted package index.

The documented Pandoc conversion example does not import or use requests, making this dependency unnecessary for the demonstrated functionality. Installing an unused package expands the software supply-chain attack surface without providing a corresponding functional benefit.

Package installation can process package metadata, installation hooks, and transitive dependencies using the privileges of the account running pip. The exact artifact selected can also change over time because no version or hash is pinned. Exploitation would require compromise or manipulation of the configured package source, package release, dependency resolution, or local package-index configuration; the audited file does not itself identify a malicious package or repository.

Attack Path

1. An AI agent or user follows the environment-preparation instructions in SKILL.md.
2. The command pip install requests is executed in the current Python environment.
3. Pip resolves mutable package artifacts and transitive dependencies from the environment's configured package index.
4. If the index configuration, selected release, or a resolved dependency has been compromised, attacker-controlled package content is downloaded and processed.
5. Malicious installation or runtime behavior executes with the privileges of the user or automation account invoking pip.

Impact Assessment

Successful exploitation could pe ...[truncated 451 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove pip install requests because the provided conversion implementation does not use that package.
2. Keep the documented dependency set minimal and list only packages required by implemented functionality.
3. If a future implementation genuinely requires requests, pin it to a reviewed version in a dependency manifest or lock file.
4. Require integrity hashes for downloaded artifacts, such as with a hash-locked requirements file and pip install --require-hashes.
5. Use an explicitly configured, trusted package index or an internally controlled package mirror.
6. Install dependencies in an isolated virtual environment or container under a non-privileged account.
7. Apply automated dependency scanning and periodically review pinned versions for known vulnerabilities before updating them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest and early description list '批量转换' as a core capability of the free edition, and later sections include a batch conversion scenario. But other sections state that the free version supports only '单次任务' and '单次操作', which materially conflicts with the claimed behavior of batch conversion.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest positions this skill as a '免费版' with '核心功能与基础用法' for personal daily use, centered on document conversion. However, the body of the skill expands the behavior well beyond basic conversion by advertising template usage, filter support, metadata handling, and generic CRUD-style operations that do not match a narrowly scoped conversion tool.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file provides generic natural-language example commands such as "把Markdown转为Word", "批量转换这些文档为HTML", and "用学术模板转换这份文档" without defining explicit activation constraints, exclusions, or a bounded trigger list. Combined with the statement that the skill is driven by natural-language instructions, this makes invocation scope ambiguous and increases the chance of unintended activation during ordinary document-related requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill includes a dedicated '批量转换' usage scenario and presents it as a supported workflow, while later lines explicitly state the free edition supports only one task or one operation at a time. These statements directly contradict each other in intent and expected behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill declares exec and write capabilities and includes subprocess-based pandoc conversion, yet it does not clearly warn users that invoking the skill will execute a local CLI and create or overwrite files. In an agent context, this can cause unintended command execution and filesystem modification, especially when processing untrusted documents or ambiguous user prompts; the risk is elevated because pandoc commonly interacts with local files and optional external tooling such as LaTeX.

Content

No source excerpt is available for this finding.