md-to-docx-template

SUSPICIOUS: The skill’s capabilities are coherent for Markdown-to-DOCX conversion and there is no sign of credential harvesting or unrelated data exfiltration. The main concern is install trust: users are told to clone and run scripts from a personal GitHub repo with limited provenance and unpinned dependencies, which creates moderate supply-chain risk disproportionate to a simple document-conversion helper.

The code is intended to modify styles and theme files in a ZIP-based document. It contains a significant archive extraction path traversal vulnerability because both input archives are passed to extractall() without member-path validation. It also risks deleting the output document on processing failure. No evidence of malware, credential theft, network exfiltration, persistence, or command execution is present in the supplied fragment. The fragment is syntactically incomplete as provided.