convert-md-to-pdf
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/converter.pyscript executes the Mermaid CLI (mmdc) viasubprocess.run. The command is constructed from a list of arguments withshell=False, which prevents shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill requires standard, well-known dependencies from PyPI (weasyprint, markdown, pygments) and NPM (@mermaid-js/mermaid-cli) to perform its core conversion tasks.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it processes untrusted markdown files. Ingestion points: Input markdown content read in
scripts/converter.py. Boundary markers: None present to delimit user content. Capability inventory: Subprocess execution ofmmdcand file-system write operations for PDF generation. Sanitization: Input is processed through the standardmarkdownlibrary and WeasyPrint, which do not execute embedded scripts in the resulting document.
Audit Metadata