Pandoc文档转换

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:40 AM UTC
• Version: 1.0.1

Overview

This document-conversion skill is not malicious, but it asks users to install unspecified GitHub code and use broad command/file access without enough scoping.

Review before installing. Use only the official Pandoc installer and do not download an unnamed GitHub project for this skill unless the publisher provides a verified repository, pinned release or commit, checksums, and exact installation commands. Avoid running conversion tooling as administrator; use a limited environment and protect any API keys or documents processed through it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:65

Finding

Unpinned Installation from an Unspecified GitHub Repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 65
Vulnerability Type: Supply-chain risk from an ambiguous and unverified dependency source
Risk Level: Medium

Vulnerable Code Snippet

markdown

2. 安装 Pandoc Document Converter：从 GitHub 下载 Pandoc Document Converter 的源代码，并按照说明进行安装。

English translation: “Install Pandoc Document Converter: Download its source code from GitHub and install it according to the instructions.”

Technical Analysis

The installation procedure directs users or agents to obtain source code from GitHub without specifying:

• The official repository URL or verified owner
• An immutable release, tag, or commit
• A required package version
• A cryptographic checksum or signature
• Exact, reviewable installation commands

Because the project name is generic, a user following this instruction may rely on GitHub or web search results to identify a repository. An attacker could publish a similarly named or search-optimized repository and provide malicious installation instructions or dependencies. The effective code installed by the user would therefore be selected outside the audited Skill package and could change after this Skill has been reviewed.

The audited project contains only SKILL.md; it does not include an implementation, package manifest, lockfile, or other mechanism that establishes dependency provenance. The documented API and conversion behavior consequently cannot be tied to a particular verified implementation.

Attack Path

1. A user or agent loads the Skill and follows the environment-preparation instructions.
2. The user searches GitHub for “Pandoc Document Converter” because no repository URL is supplied.
3. An attacker-controlled, typosquatted, or compromised repository appears in the results.
4. The user downloads that repository and follows its installation instructions.
5. Malicious setup code, package hooks, or substituted dependencies execute under the installing user's account. 6 ...[truncated 637 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the generic GitHub instruction with the exact official HTTPS repository URL and verified publisher identity.
2. Pin installation to an immutable, reviewed release or full commit hash rather than a mutable branch.
3. Publish expected SHA-256 checksums or signature-verification instructions for release artifacts.
4. Provide explicit installation commands so users do not have to trust repository-specific instructions discovered through search results.
5. Include a package manifest and lockfile with exact dependency versions where applicable.
6. Document dependency provenance and verify artifacts in CI before publication.
7. Advise users to install with an unprivileged account in an isolated environment and to review installation scripts before execution.
8. Avoid recommending administrator privileges as a generic response to permission errors; instead, correct file ownership, permissions, or output paths using the minimum privileges required.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description says the skill should be used whenever file processing, document conversion, format conversion, or content extraction is needed. These categories are very broad and overlap with common tasks, but the file does not provide explicit trigger phrases, scope boundaries, or negative examples beyond excluding encrypted-file cracking.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

These lines state that supported inputs include JSON, plain text, and Markdown and that output is uniformly JSON. However, the rest of the document repeatedly describes the skill as a document converter whose result is converted files in formats like HTML, PDF, and Word, so this Q&A contradicts the stated operational behavior rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The section states that boundary checks, fallback/default handling, and retry-with-backoff have already been implemented. Elsewhere in this skill file there is no corresponding procedural content, API definition, or code-backed description showing these features; instead, the file is primarily descriptive marketing text. This is an active documentation claim about behavior that is not substantiated in the artifact provided.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document includes a placeholder-style line for 'trigger and activation method' but does not actually define any trigger phrases or conditions. Without concrete activation criteria, the skill may be invoked in unintended contexts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.