T08 · Insecure Dependencies
Warning
- Location
README.md:8- Finding
Unpinned installation from mutable remote sources
- Content
View full analysis
- Remediation
View remediation
Security audit
Zhy Markdown2wechat
Security checks for vulnerabilities and agentic risk
Overview
This skill does the advertised Markdown-to-WeChat conversion, but it automatically installs npm packages at runtime and has unsafe file-handling behavior users should review before installing.
Install only if you are comfortable with the skill running npm during conversion and writing/deleting files in the working directory. Prefer a reviewed version that pins dependencies with a lockfile, disables install scripts or installs dependencies during setup, uses a unique OS temp directory, sanitizes generated HTML, and asks before overwriting output files.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T08 · Insecure Dependencies
Error
- Location
scripts/convert.js:11- Finding
Automatic installation and execution of insufficiently pinned npm dependencies
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/convert.js:35- Finding
Unsanitized Markdown permits active content in generated HTML
- Content
View full analysis
' + html + ''; console.log('Inlining CSS...'); const finalHtml = juice.inlineContent(wrapped, css); fs.writeFileSync(path.resolve(outPath), finalHtml); ``` ### Technical Analysis The converter parses potentially untrusted Markdown and writes the resulting HTML directly to disk. There is no HTML sanitization step between `marked.parse()` and output generation. Markdown processors can preserve raw HTML embedded in Markdown. Depending on the supplied input and browser behavior, the generated document may contain script elements, event-handler attributes, unsafe URL schemes, forms, frames, or other active content. CSS inlining performed by `juice.inlineContent()` is not a security sanitizer and must not be relied upon to remove executable HTML. The Skill documentation instructs users to open the generated file in a browser for preview, creating a concrete execution context for injected active content. ### Attack Path 1. An attacker prepares a Markdown file containing malicious raw HTML or unsafe attributes, for example an image with an error event handler or a link using an unsafe URL scheme. 2. The victim asks the Skill to convert that Markdown file. 3. `marked.parse()` preserves or translates the malicious content into HTML. 4. The converter wraps and writes the content without applying an allowlist sanitizer. 5. The victim opens the generated HTML file for preview. 6. Active content executes in the victim's browser context or deceives the victim into performing an unsafe action. ### ...[truncated 500 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/convert.js:24- Finding
Predictable temporary directory can cause deletion of pre-existing data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (13)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The helper dynamically installs packages at runtime by invoking npm through a shell command. This creates unnecessary code execution and supply-chain exposure for a task that is supposed to be a local format conversion, and it can also alter the host environment in ways the user did not explicitly approve.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Running npm install during conversion introduces network access and remote package retrieval unrelated to the core document-processing function. That expands the trust boundary from local files to the npm ecosystem at execution time, enabling supply-chain compromise or unexpected script execution if a dependency or registry path is abused.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly instructs the agent to directly execute a local Node.js script that reads a user-specified Markdown file and writes a user-specified HTML output file, but it provides no safety checks, path restrictions, confirmation step, or warning that filesystem state will be modified. In an agent setting, this creates a real risk of unauthorized file creation or overwriting, especially if a user supplies sensitive paths or if the agent executes commands automatically without adequate sandboxing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The subprocess invocation is not disclosed to the user even though it may trigger shell execution, package download, and install-time scripts. In a skill whose stated purpose is markdown conversion, this mismatch makes the behavior more dangerous because users are less likely to anticipate or sandbox it appropriately.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The script creates a temporary npm project in the current working directory and mutates local state despite being presented as a simple converter. While not as severe as arbitrary command execution, this hidden filesystem modification can violate user expectations, interfere with surrounding workflows, and serves as enabling behavior for the later package installation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
For markdown files, missing-warning findings apply when the description omits warnings about behaviors that could affect user data or system integrity. The README states that the skill reads Markdown and outputs an HTML file, but it does not explicitly disclose that this involves file creation/writes or where the file will be written.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 73% confidence
- Finding
The operational instructions and prescribed user-facing output are entirely in Chinese, including a fixed Chinese response template, which implies a language constraint. The file does not state that Chinese is optional, user-selected, or required for a documented region-specific reason.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The stylesheet inserts the English word "Reference" via the
contentproperty, which forces a specific language in the rendered UI. This can violate locale/language policy when users have not opted into English or when the skill is expected to be language-neutral.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This file is a code/config-like asset, so SQP-3 applies. The font-family includes "Microsoft YaHei" and PingFangSC-Regular, which encode a specific language/locale preference in rendering behavior, but the file provides no user opt-in or documented region-specific justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This stylesheet hard-codes the generated label content as "Reference", which imposes a specific language in rendered output. Under the language/locale policy, forcing a locale-specific term without opt-in or documented justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This CSS file contains natural-language comments such as '方案二' and 'Notion 优雅手帐风' only in Chinese, and there is no indication that the skill is intentionally region-specific or that users can opt into this locale. Under the language/locale policy rule, forcing a specific language without user choice can be a policy concern even when it appears in comments or descriptive text.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This CSS file contains natural-language comments in Chinese, including the theme description and section labels, with no indication that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in is a locale/language policy concern.
- Content