markitdown
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the 'markitdown' package from PyPI. This is an official utility from Microsoft, a well-known and trusted organization.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to perform document conversions, install dependencies, and execute batch processing scripts. This is standard functionality for the intended purpose.
- [PROMPT_INJECTION]: The skill is designed to ingest untrusted external data (such as PDFs, Office files, and web content) to generate text for the AI to process. This creates a surface for indirect prompt injection.
- Ingestion points: Data enters the agent's context through the 'markitdown' CLI and Python API 'convert' methods described in 'SKILL.md'.
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when the converted content is fed to the LLM.
- Capability inventory: The skill has access to 'Bash', 'Read', 'Write', and 'Glob' tools, which could be exploited if the agent follows malicious instructions hidden within a converted document.
- Sanitization: No explicit sanitization or filtering of the extracted content is mentioned.
Audit Metadata