markdown-master
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
convert.pyscript invokes a local web browser (Edge, Chrome, or Chromium) to generate PDF files from HTML. - Evidence: The script uses
subprocess.runwith a structured list of arguments (--headless,--disable-gpu,--no-sandbox,--print-to-pdf) to ensure commands are executed safely without shell expansion. - Path Discovery: Executable paths are discovered through known standard system locations or the
CHROME_PATHenvironment variable, which is a common developer practice. - [EXTERNAL_DOWNLOADS]: The
quality.pyscript performs network operations to validate remote links within Markdown documents. - Evidence: It uses
urllib.request.urlopenwith theHEADmethod to check the status of HTTP/HTTPS links. - Safety: The implementation includes a 5-second timeout and follows intended functionality described in the documentation.
- [REMOTE_CODE_EXECUTION]: No patterns of arbitrary remote code execution were detected. The skill relies on well-known and reputable Python packages for its operations.
- [EXTERNAL_DOWNLOADS]: The skill documentation suggests installing several common Python libraries via pip.
- Evidence: Recommended packages include
python-docx,markdown,beautifulsoup4,weasyprint, andpyyaml.
Audit Metadata