doc-to-md
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external documents provided by the user, which presents a potential surface for indirect prompt injection attacks. However, the skill includes explicit defensive instructions to the model to remain faithful to the source and avoid content drift.
- Ingestion points: Documents are processed via 'scripts/convert.sh' and then read by the model during the refinement stage.
- Boundary markers: Present in 'SKILL.md' instructions, which command the model to keep the author's words verbatim and ignore extraction noise.
- Capability inventory: The skill can execute shell commands, run Python scripts, and perform file writes to the local system.
- Sanitization: The post-processing script performs structural cleaning but does not sanitize content for adversarial instructions.
- [EXTERNAL_DOWNLOADS]: The skill references and downloads tools from established registries.
- Evidence: 'scripts/convert.sh' uses 'npx --yes markdownlint-cli2' to perform linting, which fetches the package from the NPM registry. Instructions in 'SKILL.md' also advise the user to install 'markitdown' via pip. These are well-known services and standard practices for development utilities.
- [COMMAND_EXECUTION]: The skill uses shell and Python scripts to automate the conversion process.
- Evidence: 'scripts/convert.sh' executes 'markitdown' and 'python3 scripts/postprocess.py'. The script includes a 'glob_escape' function to prevent unintended shell expansion, demonstrating a security-conscious design.
Audit Metadata