markdown-exporter
Warn
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
md-exporterpackage from PyPI and themarkdown-exportertool vianpx clawhub. These are third-party dependencies from an unverified developer (bowenliang123) not included in the trusted vendors list. - [COMMAND_EXECUTION]: The skill uses the
markdown-exporterCLI to perform file operations and conversions. - [PROMPT_INJECTION]: The skill processes external Markdown files which may contain embedded instructions or malicious content.
- Ingestion points: Input Markdown files processed by the conversion tools (e.g.,
md_to_pdf,md_to_codeblock) inSKILL.md. - Boundary markers: The skill does not define specific delimiters or instructions to the agent to ignore content within the files.
- Capability inventory: The skill can write files and directories to the system, including extracting code blocks into executable formats (
.py,.sh,.js) and creating ZIP archives. - Sanitization: There is no mechanism described for sanitizing or validating the extracted code content before it is written to the file system.
Audit Metadata