T08 · Insecure Dependencies
Warning
- Location
SKILL.md:103- Finding
Unpinned Dependency Installation with Python Environment Protection Bypass
- Content
View full analysis
- Remediation
View remediation
Security audit
Markitdown Converter
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward document-to-Markdown converter, with some install and documentation caveats but no hidden or clearly unsafe behavior.
Install in a dedicated virtual environment, prefer pinned dependency versions, and avoid the documented '--break-system-packages' command. Expect the scripts to process only the files or folders you point them at, and treat image extraction and format preservation as best-effort rather than guaranteed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
代码与声明存在部分重合：确实使用 markitdown 进行多种文档到 Markdown 的批量转换，并保留输出目录结构。但声明中的“图片提取”等功能在该代码中没有任何实现，也没有看到对图片资源的保存、导出或单独处理。另一个差异是，代码仅处理批量目录输入，不体现声明中的单文件转换场景；且写入的是 result.text_content，未见专门的‘保留格式’增强处理。总体来看，代码实现的是声明功能的一个子集，而声明包含了该代码块未体现的重要能力，因此应判定为描述与实际行为不完全一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
描述的核心方向“用 markitdown 将文档转成 Markdown”与代码总体一致，但描述声称支持多项具体能力：批量转换、图片提取、保留格式等；而给出的代码片段只处理单个文件，调用 MarkItDown().convert() 后仅将 text_content 写入 Markdown 文件，没有任何批处理逻辑、图片导出逻辑，也没有显式的格式保留处理。因此描述比实际实现明显更宽，构成能力层面的不匹配。未发现额外的可疑越权行为；问题主要是声明功能多于代码实际功能。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest description and main heading/body are written entirely in Chinese, which indicates a fixed language experience for the skill. Under the policy, locale or language constraints should either be optional for the user or explicitly justified as region-specific; neither is present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The docstring and all user-facing console messages are written only in Chinese, which imposes a specific language on users without any opt-in or alternative. Under the policy, forced language selection is a natural-language policy issue unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language strings exclusively in Chinese in the module docstring, error messages, and CLI help context. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in, and this script provides no alternative locale selection or documented justification.
- Content
Static analysis
No suspicious patterns detected.