skills/gusibi/skills/markitdown/Gen Agent Trust Hub

markitdown

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/convert.py script automatically installs the markitdown library if it is not found in the environment. It uses the Tsinghua University PyPI mirror (https://pypi.tuna.tsinghua.edu.cn/simple) to perform the installation. This library is an official tool from Microsoft designed for document conversion.
  • [COMMAND_EXECUTION]: The skill uses subprocess.check_call within scripts/convert.py to invoke the Python package manager (pip). This execution is specifically used to install the required markitdown dependency and is triggered only if the library is missing.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to parse external documents such as PDFs, spreadsheets, and slides, and then present the extracted text to the agent. This represents an ingestion surface for untrusted data. The script extracts raw text content without applying specific sanitization or adding boundary markers to the output, which could allow instructions embedded in the documents to be processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 11:30 PM