microsoft-markitdown
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from various file formats (PDF, Word, Excel, Images, etc.) and external sources like YouTube URLs.
- Ingestion points: The
markitdowncommand-line tool and Python API ingest user-provided files and remote content from YouTube URLs as described in the workflow. - Boundary markers: The instructions lack requirements for using delimiters (like XML tags or markdown blocks) or "ignore embedded instructions" warnings when the agent handles the output of the conversion process.
- Capability inventory: The skill utilizes the
markitdownlibrary which can perform network requests to external services like OpenAI and Azure Document Intelligence for transcription and OCR. - Sanitization: No sanitization, escaping, or filtering of the extracted text content is specified before the Markdown result is returned to the agent's context for further processing.
Audit Metadata