EPUB to Markdown

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:33 PM UTC
• Version:
  1.1.1

Overview

This skill appears to do what it says: convert a user-selected EPUB into local Markdown files without hidden credential access, exfiltration, or persistence.

Before installing, know that first use may download Python packages through `uv`, and conversion will create files beside the EPUB or in the output directory you choose. Use `--overwrite` only for a generated export directory you are comfortable replacing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill invokes a local conversion script via `uv run`, and the script declares inline dependencies that `uv` may download automatically on first use. That means the skill has effective network and file-write capabilities despite not declaring permissions, which creates a trust and transparency gap and can expose users to unreviewed dependency retrieval or unexpected filesystem modifications.

VirusTotal

66/66 vendors flagged this skill as clean.