baoyu-markdown-to-html

Warn

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The script languages.ts dynamically downloads and executes JavaScript modules from an external CDN (cdn-doocs.oss-cn-shenzhen.aliyuncs.com) to support additional syntax highlighting languages at runtime via the import() function. Additionally, infographic.ts performs a dynamic import of the @antv/infographic package which is not declared in the skill's package dependencies.
  • [EXTERNAL_DOWNLOADS]: The main.ts script fetches remote images from URLs provided in the Markdown source and saves them to a temporary local directory for processing.
  • [COMMAND_EXECUTION]: The main entry point main.ts uses spawnSync to execute local rendering scripts through npx and bun.
  • [DATA_EXFILTRATION]: Markdown code for diagrams is processed and sent to an external rendering server (www.plantuml.com) to generate image assets, which involves sending user-provided document content to a third-party service.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 21, 2026, 02:10 AM