markdown-to-image
Warn
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to execute
npx inkframe, which downloads and runs the 'inkframe' package from the npm registry at runtime. This introduces a dependency on an external, third-party codebase that is not version-locked or verified. - [DATA_EXFILTRATION]: The tool supports an
@prefix convention (e.g.,--content @file.md) that triggers local file reading. When this feature is used, the CLI reads the content of the specified file and sends it to theinkframe.devAPI for rendering. This capability could be misused to exfiltrate sensitive local data, such as configuration files or credentials. - [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands directly. It specifically encourages complex execution patterns, such as running multiple render tasks in parallel using background processes (
&) and synchronization (wait). - [INDIRECT_PROMPT_INJECTION]: The skill ingests markdown content from potentially untrusted files or user input via the
--contentflag inSKILL.md. It lacks explicit boundary markers or instructions to ignore embedded commands. Given the skill's access to local files and the network, this ingestion point creates a surface where malicious instructions hidden in the markdown could influence the agent's behavior during the rendering process.
Audit Metadata