Security audit

everything to markdown

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a normal document-to-Markdown helper, but it installs a broad third-party converter bundle and should be used carefully with sensitive files.

Install this in an isolated environment, avoid running the install as administrator, and be cautious with confidential documents, media, or URLs. Use trusted plugins or custom converters only, and pin dependencies if reproducibility or supply-chain control matters.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:11
Finding: Unpinned Installation of MarkItDown and Its Optional Dependency Tree
Content: View full analysis
Remediation: View remediation
' ``` 2. Generate and maintain a dependency lockfile containing pinned transitive dependency versions and cryptographic hashes. Install it with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Avoid the `[all]` extra unless every optional converter is required. Install only the extras necessary for the supported workflows to reduce the supply-chain attack surface. 4. Use an isolated virtual environment rather than modifying the system Python environment: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 5. Configure an explicitly trusted package index or an internally controlled package mirror. Prevent fallback to untrusted or unintended indexes. 6. Review and update pinned dependencies through a controlled process that includes vulnerability scanning, provenance verification, and testing before deployment. 7. Ensure automated agents do not install packages with administrator or root privileges. Run document conversion in a sandbox with restricted filesystem and network access. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The installation step uses markitdown[all], which broadens the dependency and capability surface without warning users that additional tooling, plugins, or integrations may process content in unexpected ways. In an agent environment, this can silently increase exposure to external executables, network-enabled helpers, and complex parsers acting on untrusted input.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises audio transcription, OCR, and YouTube processing without warning that some formats or dependencies may invoke external services, models, or network-accessing tools. Users may supply sensitive documents or media under the assumption of local-only processing, creating a privacy and data-handling risk in agent workflows.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documented example explicitly enables plugins and accepts custom converters, which can extend behavior far beyond simple document-to-Markdown conversion. In an agent context, this increases the trusted execution surface and may allow unreviewed code paths or externally sourced processing logic to handle sensitive user files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.