md-to-pdf
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs legitimate Markdown-to-PDF conversion as described in its documentation.
- [COMMAND_EXECUTION]: The skill uses the
uvtool to manage Python environments and execute its scripts, which is a standard and safe practice for Python-based tools. - [DATA_EXFILTRATION]: File access is limited to reading the user-provided Markdown file, referenced local images, and writing the resulting PDF. These operations are within the expected scope of a document converter and do not involve network transmission.
- [INDIRECT_PROMPT_INJECTION]: The script processes external Markdown files (untrusted data), but it includes a
sanitize_textfunction to escape XML special characters, protecting the underlying ReportLab rendering engine. The tool's output does not provide an avenue for prompt hijacking as it does not feed instruction-rich content back into the agent's primary reasoning loop.
Audit Metadata