markdown-proxy
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect prompt injection vulnerability surface. The skill ingests untrusted data from external URLs and interpolates the resulting Markdown directly into the agent's context without sanitization or robust boundary markers.
- Ingestion points: External web content is fetched via r.jina.ai, defuddle.md, or local Python scripts as defined in SKILL.md and scripts/ directory.
- Boundary markers: Content is delimited only by Markdown headers (e.g., ### 正文) without specific 'ignore instructions' warnings.
- Capability inventory: The skill can execute shell commands (curl, npx, python3, playwright) and write files to the local file system (~/Downloads/).
- Sanitization: No sanitization, escaping, or filtering of the retrieved web content is performed before presentation to the agent.
- [EXTERNAL_DOWNLOADS]: The skill utilizes well-known external services and tools for content extraction.
- Fetches Markdown content from the r.jina.ai and defuddle.md proxy services using curl.
- Employs the agent-fetch utility via npx as a fallback mechanism.
- Requires installation of Python dependencies (playwright, beautifulsoup4, lxml) and the Chromium browser engine via playwright install chromium.
- [DATA_EXFILTRATION]: User-supplied URLs are transmitted to third-party services (r.jina.ai and defuddle.md) to perform the conversion process.
- [COMMAND_EXECUTION]: The skill invokes local scripts and command-line tools to process URLs and manage files.
- Executes scripts/fetch_weixin.py and scripts/fetch_feishu.py using python3.
- Executes npx agent-fetch and curl commands.
Audit Metadata