markdown-exporter

Warn

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the md-exporter package from PyPI and the markdown-exporter tool via npx clawhub. These are third-party dependencies from an unverified developer (bowenliang123) not included in the trusted vendors list.
  • [COMMAND_EXECUTION]: The skill uses the markdown-exporter CLI to perform file operations and conversions.
  • [PROMPT_INJECTION]: The skill processes external Markdown files which may contain embedded instructions or malicious content.
  • Ingestion points: Input Markdown files processed by the conversion tools (e.g., md_to_pdf, md_to_codeblock) in SKILL.md.
  • Boundary markers: The skill does not define specific delimiters or instructions to the agent to ignore content within the files.
  • Capability inventory: The skill can write files and directories to the system, including extracting code blocks into executable formats (.py, .sh, .js) and creating ZIP archives.
  • Sanitization: There is no mechanism described for sanitizing or validating the extracted code content before it is written to the file system.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 19, 2026, 07:46 PM
Security Audit — agent-trust-hub — markdown-exporter