to-md
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The conversion pipeline relies on reputable external tools managed through standard package registries.
- The conversion utility,
markitdown, is a verified project from Microsoft available via the Python Package Index (PyPI). - The
scripts/convert.shscript executesnpx --yes markdownlint-cli2, which is a standard development tool retrieved from the official npm registry. - [SAFE]: The logic and implementation follow established security best practices.
- The shell script
scripts/convert.shuses double-quoting for all file path variables, protecting against potential command injection from malformed filenames. - The
scripts/postprocess.pyscript performs semantic cleanup using standard regular expressions and library functions, focusing on structural improvements like JSON fencing and table row sanitization. - The skill includes clear operational guidelines that prioritize the preservation of original document text, which helps mitigate risks associated with processing data from external, untrusted files.
Audit Metadata