Markdown to HTML Converter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:25 AM UTC
• Version: 1.0.0

Overview

This skill is for a Markdown-to-HTML converter, but its generated app guidance has avoidable browser security risks and a misleading offline-use claim.

Review before installing or using this skill. It appears purpose-built, not malicious, but users should vendor or pin dependencies with integrity hashes, remove or clarify the offline claim, and add HTML sanitization plus a restrictive preview/download security boundary before handling Markdown from untrusted sources.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:179
• Finding: Unpinned Executable CDN Dependency Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:179-183, 330` **Vulnerability Type**: Unpinned third-party dependency and missing Subresource Integrity **Risk Level**: Medium ### Vulnerable Code ```html <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script> <link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.9.0/build/styles/github.min.css"> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.9.0/build/highlight.min.js"></script> ``` The dependency guidance also states: ```text - marked.js (latest stable version) - highlight.js v11.9.0 ``` ### Technical Analysis The `marked` script URL does not specify an exact package version. Consequently, separate builds or application loads can receive different executable JavaScript without any corresponding change to the reviewed Skill. The instructions explicitly reinforce this mutable dependency policy by requesting the “latest stable version.” None of the CDN resources have a Subresource Integrity (`integrity`) attribute. Although the highlight.js URLs specify version 11.9.0, the browser has no cryptographic mechanism to confirm that the returned files match reviewed content. This creates a supply-chain trust boundary in which the generated application executes code controlled by the package publisher and CDN infrastructure. The finding does not establish that the current CDN content is malicious; the risk is that upstream changes or compromise can alter the effective application after review. ### Attack Path 1. An attacker compromises a relevant upstream package release, publishing account, CDN account, or delivery path. 2. The attacker modifies the JavaScript served through the referenced CDN URL. 3. A user opens an application generated according to the Skill. 4. The browser retrieves and executes the modified dependency because the URL is unpinned or lacks integrity enforcement. 5. The malicious dependency accesses Markdown ...[truncated 680 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an exact, reviewed version. For example: ```html <script src="https://cdn.jsdelivr.net/npm/marked@EXACT_VERSION/marked.min.js" integrity="sha384-REVIEWED_HASH" crossorigin="anonymous"></script> ``` 2. Add reviewed `integrity` hashes and `crossorigin="anonymous"` to every externally loaded script and stylesheet. 3. Prefer vendoring verified dependency files locally or installing them through a lockfile-controlled build process. 4. Remove guidance to use the “latest stable version.” Dependency upgrades should be explicit, reviewed, tested, and accompanied by updated integrity hashes. 5. Apply a restrictive Content Security Policy that limits script and style sources to the minimum required origins. 6. Use automated dependency monitoring, but do not automatically deploy unreviewed version updates. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:222
• Finding: Untrusted Markdown Converted to Active HTML Without Required Sanitization<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:222-226, 233-239` **Vulnerability Type**: Untrusted HTML generation and potential cross-site scripting **Risk Level**: High ### Vulnerable Code The documented upload handler validates only the file-name extension before reading attacker-controllable content: ```javascript async handleFileUpload(file) { // Validate file type if (!file.name.toLowerCase().endsWith('.md')) { throw new Error('Only .md files are supported'); } // Read file content return new Promise((resolve, reject) => { const reader = new FileReader(); reader.onload = (e) => resolve(e.target.result); reader.onerror = () => reject(new Error('File read failed')); reader.readAsText(file); }); } ``` The generated content is then obtained directly from the Markdown parser: ```javascript generateHTML(markdown) { const themeId = AppState.currentTheme; const parsedHTML = markdownParser.parse(markdown); const baseCSS = `* { box-sizing: border-box; margin: 0; padding: 0; } body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; padding: 2rem; } .content { max-width: 700px; margin: 0 auto; }`; const themeCSS = this.getThemeCSS(themeId); return `<!DOCTYPE html><html>...</html>`; } ``` No output sanitizer, HTML allowlist, URL-scheme validation, sandbox requirement, or restrictive Content Security Policy is specified before parsed content is used for live preview or downloadable HTML. ### Technical Analysis A `.md` extension establishes neither file authenticity nor content safety. Markdown documents can contain raw HTML, links, images, and other constructs that may become active browser content. A Markdown parser is not a security sanitizer. If parser output is assigned to an HTML-rendering sink, dangerous elements, event-handler attributes, unsafe URL schemes, or embedded content can be interpret ...[truncated 1793 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Sanitize parser output with a maintained HTML sanitizer such as DOMPurify before any preview rendering or document generation: ```javascript const parsedHTML = markdownParser.parse(markdown); const safeHTML = DOMPurify.sanitize(parsedHTML, { USE_PROFILES: { html: true } }); ``` 2. Define a strict allowlist appropriate for blog content. Remove scripts, inline event handlers, dangerous embedded elements, and unneeded attributes. 3. Validate URL-bearing attributes and reject dangerous schemes such as `javascript:`. Restrict remote resources if documents may contain confidential data. 4. Do not treat file-extension validation as a security control. Retain it only as a usability check and separately enforce file-size limits to prevent browser resource exhaustion. 5. Render the preview inside a sandboxed iframe without `allow-scripts` unless scripts are an explicit, justified requirement. 6. Apply a restrictive Content Security Policy to both the application and generated documents. Avoid `unsafe-inline` and prevent unnecessary framing, plugins, and external connections. 7. Ensure the sanitized value—not the original parser output—is used consistently by both the live preview and download generator. 8. Add security regression tests containing raw HTML, event handlers, unsafe links, malformed tags, SVG payloads, and parser edge cases. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This markdown file contains the skill's natural-language instructions entirely in Chinese, including the title, overview, usage guidance, and troubleshooting sections. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill advertises offline/local use, but its documented implementation depends on third-party CDN-hosted JavaScript and CSS. That mismatch can mislead users into trusting a local-only threat model while actually introducing network dependencies, supply-chain risk, availability issues, and privacy leakage when the page loads remote assets.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: For a Markdown-to-HTML converter presented as an offline/local tool, remote CDN loading is unnecessary and expands the attack surface. If a CDN asset is tampered with, blocked, or replaced, the generated app can execute attacker-controlled code in the browser and potentially expose user-provided Markdown content or downloaded output.

Static analysis

No suspicious patterns detected.