alterlab-markitdown
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data sources, including PDFs, Office documents, and web content, to generate Markdown for LLM ingestion. This creates a surface for indirect prompt injection attacks where malicious instructions embedded in documents could be executed by the agent.
- Ingestion points: Document conversion calls using the MarkItDown library and CLI throughout scripts such as scripts/batch_convert.py and scripts/convert_with_ai.py.
- Boundary markers: The skill lacks explicit delimiters or system instructions to wrap converted content, making it difficult for the agent to distinguish document text from intended commands.
- Capability inventory: The agent has access to high-impact capabilities including Bash, Write, and Edit, increasing the potential risk of successful injection attacks.
- Sanitization: No filtering or sanitization is performed on the extracted text to mitigate malicious content before it enters the agent's context.
Audit Metadata