convert-docx

Pass

Audited by Gen Agent Trust Hub on Apr 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Executes a shell command to invoke the markitdown Python module on user-supplied file paths.
  • [EXTERNAL_DOWNLOADS]: Depends on the markitdown package, which is a well-known and trusted library from Microsoft.
  • [PROMPT_INJECTION]: Vulnerable to indirect prompt injection through processed document content.
  • Ingestion points: Untrusted Word documents are read and converted in SKILL.md.
  • Boundary markers: Absent; the output does not include delimiters or instructions to ignore embedded commands.
  • Capability inventory: The skill environment allows Bash, Read, Write, and Skill operations as defined in SKILL.md.
  • Sanitization: Absent; the tool performs a direct format conversion without content filtering.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 2, 2026, 06:17 AM
Security Audit — agent-trust-hub — convert-docx