Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently converts user-provided Markdown into DOCX files, with expected local file reads and writes and no artifact-backed evidence of hidden persistence, snooping, exfiltration, or destructive behavior.
Install only if you want an explicit Markdown-to-DOCX converter that can read local Markdown/images and write DOCX files. Use explicit output paths, avoid running it on hostile Markdown until dependencies are updated, and keep Mermaid support disabled unless you specifically need Chromium-backed diagram rendering.
Referenced artifact was not completely inspected
1. Prefer the shared agent wrapper in [skill.mjs](skill.mjs), specifically `convertWithAgentSkill()`. Do not create a second conversion path.
Referenced artifact was not completely inspected
1. Prefer the shared agent wrapper in [skill.mjs](skill.mjs), specifically `convertWithAgentSkill()`. Do not create a second conversion path.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
image-size is used by html-to-docx and parses image metadata; if the skill converts untrusted Markdown/HTML containing attacker-controlled images, malformed JXL/HEIF/ICNS files could trigger infinite-loop denial of service during conversion. That is directly relevant to a document-conversion skill exposed to arbitrary user content.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
linkify-it is used by markdown-it in the core Markdown parsing path, and the cited quadratic-complexity bugs can let crafted Markdown consume excessive CPU during conversion. Because this skill explicitly processes user-supplied Markdown, parser-level algorithmic DoS is plausibly reachable and relevant.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# Claude Code
mkdir -p ~/.claude/skills
unzip -oq marktodocx-skill.zip -d ~/.claude/skills
# OpenClaw
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Then copy it into the default Claude Code skills root:
mkdir -p ~/.claude/skills
cp -R apps/agent-skill/dist/marktodocx-skill ~/.claude/skills/marktodocx-skill
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Then copy it into the default Claude Code skills root:
mkdir -p ~/.claude/skills
cp -R apps/agent-skill/dist/marktodocx-skill ~/.claude/skills/marktodocx-skill
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Then copy it into the default Claude Code skills root:
mkdir -p ~/.claude/skills
cp -R apps/agent-skill/dist/marktodocx-skill ~/.claude/skills/marktodocx-skill
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Then copy it into the default Claude Code skills root:
mkdir -p ~/.claude/skills
cp -R apps/agent-skill/dist/marktodocx-skill ~/.claude/skills/marktodocx-skill
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Then copy it into the default Claude Code skills root:
mkdir -p ~/.claude/skills
cp -R apps/agent-skill/dist/marktodocx-skill ~/.claude/skills/marktodocx-skill
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Then copy it into the default Claude Code skills root:
mkdir -p ~/.claude/skills
cp -R apps/agent-skill/dist/marktodocx-skill ~/.claude/skills/marktodocx-skill
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Then copy it into the default Claude Code skills root:
mkdir -p ~/.claude/skills
cp -R apps/agent-skill/dist/marktodocx-skill ~/.claude/skills/marktodocx-skill
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Common deployment roots:
- Claude Code default skills root: `~/.claude/skills/`
- OpenClaw workspace skills root: `~/.openclaw/workspace/skills/`
Use a symlink only when you deliberately want a development-time deployment that continues to point at the local export directory.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Common deployment roots:
- Claude Code default skills root: `~/.claude/skills/`
- OpenClaw workspace skills root: `~/.openclaw/workspace/skills/`
Use a symlink only when you deliberately want a development-time deployment that continues to point at the local export directory.
The skill changes file permissions with fs.chmod to add execute bits, which is a system-affecting file modification. There is no visible confirmation prompt, user-facing log, or inline warning explaining that the skill may alter permissions of bundled browser binaries before execution.
This markdown file documents that if outputPath is omitted, the skill writes a .docx file next to the source Markdown file. Because this behavior affects user files and the surrounding filesystem, the skill description should clearly warn users that conversion may create or overwrite local files, rather than only describing it as a parameter default.
This markdown file documents that the skill writes a .docx file to outputPath, or next to the source Markdown file when outputPath is omitted. Because this behavior affects user files, the skill description should include a clear warning about where files will be created and whether existing files may be overwritten.
dompurify is a sanitizer inside the optional Mermaid rendering path, and multiple sanitizer-bypass advisories mean attacker-supplied diagram content could survive sanitization and execute unexpected markup/script logic during rendering. In a Markdown conversion skill that may process untrusted user content, a broken sanitizer is security-relevant even if the package is only optional.
markdown-it is part of the primary document conversion flow, and the reported quadratic smartquotes behavior could let crafted text degrade performance or hang conversions. This is a real but relatively low-impact denial-of-service issue in a content-processing skill.
mermaid is an optional but explicitly included runtime feature for rendering diagrams from Markdown, and multiple advisories include infinite-loop DoS and prototype pollution. Since Mermaid would process attacker-controlled diagram definitions embedded in Markdown, these issues are relevant whenever the optional Mermaid path is enabled.
The overrides section uses caret ranges instead of exact versions, which permits future patch/minor releases to be selected at install time. That weakens build reproducibility and can unexpectedly introduce a vulnerable or incompatible transitive dependency into a document-conversion skill that processes potentially untrusted Markdown content.
"@marktodocx/runtime-node-mermaid": "file:./vendor/marktodocx-runtime-node-mermaid-0.1.0.tgz"
},
"overrides": {
"highlight.js": "^11.11.1",
"html-to-docx": "^1.8.0",
"jszip": "^3.10.1",
"markdown-it": "^14.1.1",
No suspicious patterns detected.