baoyu-markdown-to-html
Warn
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script
languages.tsdynamically downloads and executes JavaScript modules from an external CDN (cdn-doocs.oss-cn-shenzhen.aliyuncs.com) to support additional syntax highlighting languages at runtime via theimport()function. Additionally,infographic.tsperforms a dynamic import of the@antv/infographicpackage which is not declared in the skill's package dependencies. - [EXTERNAL_DOWNLOADS]: The
main.tsscript fetches remote images from URLs provided in the Markdown source and saves them to a temporary local directory for processing. - [COMMAND_EXECUTION]: The main entry point
main.tsusesspawnSyncto execute local rendering scripts throughnpxandbun. - [DATA_EXFILTRATION]: Markdown code for diagrams is processed and sent to an external rendering server (
www.plantuml.com) to generate image assets, which involves sending user-provided document content to a third-party service.
Audit Metadata