convert-documents-to-markdown
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y @firecrawl/anydocto download and execute the conversion package directly from the NPM registry at runtime. - [COMMAND_EXECUTION]: Instructions direct the agent to execute shell commands using
npxto perform document conversions and write output to the filesystem (e.g.,npx -y @firecrawl/anydoc <file> -o out.md). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process various external document formats which may contain untrusted data.
- Ingestion points: Local files including
.doc,.pdf,.xls, and.epubare read and converted to text (SKILL.md). - Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings for the converted output.
- Capability inventory: The skill has the capability to write converted content to new files using the
-oflag. - Sanitization: There is no mention of sanitization or filtering of the content extracted from the documents before it is presented to the agent context.
Audit Metadata