confluence-to-md
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill scripts (batch-convert.py, confluence-preflight.py, and confluence-to-md.py) are designed to locate and read from .env files within the project root to retrieve sensitive environment variables, including CONFLUENCE_EMAIL and CONFLUENCE_TOKEN.
- [COMMAND_EXECUTION]: The skill utilizes subprocess.run to execute system commands. confluence-to-md.py invokes the pandoc system utility to handle HTML-to-Markdown conversion, and the preflight and batch scripts execute confluence-to-md.py as a subprocess. While arguments are passed as lists to reduce shell injection risk, the skill relies on the execution of system binaries.
- [EXTERNAL_DOWNLOADS]: The skill connects to Confluence API endpoints (*.atlassian.net) and the Atlassian media CDN (api.media.atlassian.com) to retrieve page content and images. These are well-known technology services.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external Confluence pages and converts it to Markdown for the agent's context, which could be used to bypass safety guidelines.
- Ingestion points: Confluence REST API (storage and view formats) in confluence-to-md.py.
- Boundary markers: The generated Markdown does not include delimiters or safety instructions to distinguish converted content from system instructions.
- Capability inventory: The skill possesses file write access, network access to Atlassian domains, and the ability to execute system commands via subprocess.
- Sanitization: Content is structurally converted via pandoc and cleaned using regular expressions, but there is no filtering for potential prompt injection payloads within the page text.
Audit Metadata