markit-markdown-converter

SUSPICIOUS. The core markdown-conversion behavior and official-provider API use are broadly aligned with the stated purpose, and the scanner’s command-injection hits are documentation false positives. The main concerns are install-trust and scope expansion: the skill is attributed to ara.so while package provenance points elsewhere, it recommends a deprecated package name, supports arbitrary plugin installation from npm/git/local code, and allows credentials/content to be routed to custom LLM endpoints. Not confirmed malware, but the execution and credential boundaries are broader than a simple converter skill.