mddoc

• Outcome: Review
• Latest audit: Aug 19, 2026 · 5:43 AM UTC
• Version: 0.1.10

Overview

The skill is a coherent Markdown-to-DOCX converter, but it needs Review because it can install unpinned packages persistently and fetch arbitrary image URLs during conversion.

Install only if you are comfortable with a converter that may create a persistent Python environment, download dependencies from an external package index, and fetch image URLs embedded in Markdown. Avoid running it on untrusted Markdown unless remote image fetching is disabled or reviewed first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 3) 依赖缺失 → 仅此时安装
        pip = venv / bin_dir(venv) / ('pip.exe' if sys.platform == 'win32' else 'pip')
        print(f'[mddoc] 安装缺失依赖: {PIP_PACKAGES}（镜像: {PIP_INDEX}）', file=sys.stderr)
        subprocess.run([str(pip), 'install', '--disable-pip-version-check',
                        '-i', PIP_INDEX]
                       + PIP_PACKAGES.split(), check=True)
    except subprocess.CalledProcessError as exc:

• Confidence: 94% confidence
• Finding: This code performs a network package installation at runtime using pip into a persistent virtual environment. Although the subprocess invocation itself is not shell-injected, it expands the skill's capability from document conversion to fetching and executing third-party code from the network, creating a supply-chain and host-modification risk if the mirror, package resolution, or environment is compromised.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exposes capabilities for shell execution, filesystem access, environment mutation, and network access without declaring or constraining them. This is risky because a user invoking a seemingly simple Markdown-to-DOCX converter may unknowingly trigger package installation, local file reads/writes, and outbound requests, expanding the attack surface beyond document conversion.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes beyond format conversion by creating a virtual environment, installing packages from a mirror, downloading remote images, and reading local resources. This mismatch can mislead users and host systems into granting trust to a skill that performs supply-chain, privacy, and local-file access operations not clearly disclosed in its stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Fetching remote images during conversion allows untrusted Markdown content to trigger outbound HTTP requests. That can leak user IP/network metadata, enable tracking, and potentially access internal resources if attacker-controlled URLs or internal endpoints are embedded in the Markdown.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Automatic virtualenv creation and package installation mutate the local environment and introduce dependency supply-chain risk unrelated to a narrow conversion task. If a package source is compromised or dependencies change unexpectedly, the host may execute untrusted code during what appears to be a document-formatting operation.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The converter resolves Markdown image references by calling download_image(), which supports HTTP/HTTPS URLs in addition to local files and data URIs. That means a seemingly local document-conversion skill can initiate outbound network requests based solely on untrusted Markdown content, enabling SSRF-like access to internal resources, privacy leaks, and behavior beyond the user’s expected trust boundary.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The HTTP branch uses requests.get(url, headers=headers, timeout=30) on attacker-controlled Markdown image URLs, giving the skill active network capability. In an agent environment, this can be abused to probe internal services, access cloud metadata endpoints, or exfiltrate request-side information through outbound fetches during document rendering.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The setup script downloads and installs packages from the network during skill setup, which exceeds a narrowly scoped markdown-to-docx conversion function. This introduces avoidable supply-chain risk and allows persistent code to be added to the host from an external package index, making compromise of the mirror or dependency chain impactful.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Maintaining a reusable virtual environment under a user cache directory causes persistent filesystem changes outside the immediate document-conversion task. In an agent setting, this broader host modification increases attack surface, creates state across sessions, and can be abused to persist altered dependencies or unexpected executables.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation omits a warning that conversion may download external images, causing unannounced outbound requests. In practice, this can expose sensitive network metadata and surprise users who expect purely local document processing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Remote image downloads happen implicitly during conversion with no user-facing warning, even though the skill description suggests Markdown-to-DOCX transformation rather than network retrieval. This lack of disclosure increases the risk of surprising outbound requests, privacy violations, and unsafe processing of attacker-supplied content in higher-trust environments.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.