marker

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward PDF-to-Markdown helper that runs a documented local converter on user-provided PDFs, with only ordinary dependency and local-command cautions.

Install only if you are comfortable running the third-party marker-pdf converter locally on PDFs you choose. Prefer a virtual environment, avoid elevated privileges, and pin or review the marker-pdf version before use in sensitive workflows.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:12

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code Snippet

markdown

- `marker_single` on PATH (`pip install marker-pdf` if missing)

Technical Analysis

The documentation recommends installing marker-pdf without specifying a reviewed version, package hash, trusted package index, or lock file. Consequently, the installed code is determined by the package repository at installation time and may differ from the version originally reviewed.

This is a supply-chain hardening weakness rather than evidence that the current marker-pdf package is malicious. Exploitation would require compromise of the package, its maintainer account, or the package distribution channel. A malicious release could execute code during installation or when the script subsequently invokes marker_single.

The local wrapper otherwise uses subprocess.run with an argument list and without shell=True; no command-injection path was identified in that invocation.

Attack Path

1. An attacker compromises the marker-pdf publishing account, package repository, or another relevant distribution component.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the documented command pip install marker-pdf.
4. The package manager retrieves the malicious release because no version or integrity hash is enforced.
5. Attacker-controlled code runs during installation or when marker_single is invoked for PDF conversion.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user who installs or runs the package. This could expose files and credentials accessible to that account, alter generated conversion output, or modify the user's environment. The scope would normally be limited to the installing user's permissions unless installation is performed with elevated privileges.

Remediation

View remediation

Remediation Suggestions

• Pin marker-pdf to a specifically reviewed version, for example through a locked requirements file.
• Require package hashes by using a hash-locked installation workflow such as pip install --require-hashes -r requirements.txt.
• Configure an explicit, trusted package index rather than relying on ambient package-manager configuration.
• Install the dependency in a dedicated virtual environment or restricted container without elevated privileges.
• Establish a controlled dependency-update process that reviews new versions before changing the pin.
• Document the tested marker-pdf version alongside the existing Python version requirement.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documentation explicitly directs use of local file access and shell execution via a Python script and the marker_single CLI, but it does not declare any permissions or allowed-tools scope. That mismatch weakens enforcement and review boundaries: an agent may invoke file reads or shell commands without an explicit capability declaration, making unintended file exposure or command execution harder to govern.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/marker_to_markdown.py (reported line 29)May include surrounding context.

python

]

    try:
        return subprocess.run(
            cmd,
            check=True,
            capture_output=True,

Static analysis

No suspicious patterns detected.