mkd
Fail
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill's instructions in SKILL.md advise the AI to suggest that the user install the Bun runtime via a shell script fetched from a well-known service (
bun.sh). - [COMMAND_EXECUTION]: The skill spawns subprocesses to perform repository checks via Git, open the system browser, and interface with the Orca IDE via system command calls.
- [INDIRECT_PROMPT_INJECTION]: The skill processes externally provided JSON specifications to generate user interfaces.
- Ingestion points: Specification files (JSON) provided as command-line arguments to the CLI (e.g.,
~/.mkd/spec-<name>.json). - Boundary markers: The skill uses HTML escaping for content interpolation and provides instructions for the user to provide anchored feedback.
- Capability inventory: The skill can write files to the home directory (
~/.mkd/), start a loopback HTTP server (127.0.0.1), and execute system commands for browser and tool interaction. - Sanitization: A custom markdown renderer (
markdown.ts) and the document assembler (render.ts) perform HTML escaping of special characters for all user-controlled fields (title, problem, content, justifications, labels) before rendering. - [EXTERNAL_DOWNLOADS]: The generated decision decks reference and fetch typography assets from a well-known service (Google Fonts).
Recommendations
- HIGH: Downloads and executes remote code from: https://bun.sh/install - DO NOT USE without thorough review
Audit Metadata