The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses standard command-line execution to run its Python conversion script (python scripts/convert.py). This is the intended primary purpose of the skill and does not involve arbitrary command injection.
[EXTERNAL_DOWNLOADS]: The skill depends on the markitdown Python package from a well-known service (PyPI/Microsoft). The SKILL.md documentation also references a legitimate GitHub repository for Microsoft MarkItDown and the author's own repository. These are documented neutrally and do not escalate the verdict.
[DATA_EXFILTRATION]: No evidence of unauthorized data exfiltration was found. The script processes local files provided by the user and either outputs to stdout or a user-specified local file path.
[REMOTE_CODE_EXECUTION]: No remote code execution patterns or dynamic code evaluation (eval, exec) were detected. The script uses standard libraries for file and archive handling.
[PROMPT_INJECTION]: No instructions attempting to bypass safety filters or override agent behavior were found. The instructions focus on document conversion workflows.

markitdown-converter