markdown-master

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The convert.py script invokes a local web browser (Edge, Chrome, or Chromium) to generate PDF files from HTML.
  • Evidence: The script uses subprocess.run with a structured list of arguments (--headless, --disable-gpu, --no-sandbox, --print-to-pdf) to ensure commands are executed safely without shell expansion.
  • Path Discovery: Executable paths are discovered through known standard system locations or the CHROME_PATH environment variable, which is a common developer practice.
  • [EXTERNAL_DOWNLOADS]: The quality.py script performs network operations to validate remote links within Markdown documents.
  • Evidence: It uses urllib.request.urlopen with the HEAD method to check the status of HTTP/HTTPS links.
  • Safety: The implementation includes a 5-second timeout and follows intended functionality described in the documentation.
  • [REMOTE_CODE_EXECUTION]: No patterns of arbitrary remote code execution were detected. The skill relies on well-known and reputable Python packages for its operations.
  • [EXTERNAL_DOWNLOADS]: The skill documentation suggests installing several common Python libraries via pip.
  • Evidence: Recommended packages include python-docx, markdown, beautifulsoup4, weasyprint, and pyyaml.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 07:44 AM
Security Audit — agent-trust-hub — markdown-master