The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The main conversion script scripts/md2word.py automatically downloads images from arbitrary HTTP/HTTPS URLs found in Markdown files using the urllib.request.urlopen function. This functionality is enabled by default to allow external assets to be embedded in the output document.
[DATA_EXFILTRATION]: The unrestricted image download feature introduces a Server-Side Request Forgery (SSRF) vulnerability. An attacker could provide a Markdown document containing URLs that point to internal network services or cloud instance metadata endpoints (such as http://169.254.169.254/). The skill would then attempt to fetch these resources, potentially leaking internal network information or environment metadata into the generated Word document.
[COMMAND_EXECUTION]: The skill uses subprocess.run to execute external binaries for rendering visual content. Specifically, scripts/chart_handler.py executes mmdc to render Mermaid diagrams, and scripts/svg_handler.py executes rsvg-convert or node. These tools process user-supplied source code (Mermaid diagrams or SVG markup) which, if malicious, could exploit vulnerabilities in the rendering engines or cause local resource exhaustion.
[INDIRECT_PROMPT_INJECTION]: As a tool that processes external Markdown and HTML, the skill is susceptible to indirect prompt injection. Malicious instructions could be embedded in source documents (e.g., via HTML comments or zero-width characters) and subsequently passed to other agents that process the resulting Word file. The skill lacks sanitization or explicit boundary markers to mitigate this risk.
Ingestion points: Markdown and HTML files processed by scripts/md2word.py
Boundary markers: None present
Capability inventory: Shell command execution via subprocess.run in chart_handler.py and svg_handler.py, and arbitrary network requests in md2word.py
Sanitization: No sanitization of the input content is performed beyond format conversion.

md2word