Skills
Navigate
skills/varlabz/skills/convert-to-markdown/Gen Agent Trust Hub

convert-to-markdown

Pass

Audited by Gen Agent Trust Hub on May 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches content from remote URLs to perform its conversion tasks. scripts/html-to-md.py fetches web content, scripts/mhtml-to-md.py downloads MHTML files, and scripts/youtube-transcript.py retrieves data from YouTube.
  • [COMMAND_EXECUTION]: The skill utilizes uvx in its shebangs to dynamically manage and execute Python dependencies (httpx, markitdown, yt-dlp) for its scripts.
  • [PROMPT_INJECTION]: The skill processes untrusted external data, creating a surface for indirect prompt injection (Category 8).
  • Ingestion points: Web page content (via URLs), MHTML file contents, and YouTube video transcripts.
  • Boundary markers: The scripts do not implement specific boundary markers or delimiters to isolate the converted content from the agent's primary instructions.
  • Capability inventory: html-to-md.py can write results to local files using the -o argument. mhtml-to-md.py can read local files if provided as a path. youtube-transcript.py interacts with external APIs.
  • Sanitization: youtube-transcript.py removes VTT markup from transcripts. mhtml-to-md.py relies on the MarkItDown library to parse and convert HTML structure.
Audit Metadata
Risk Level
SAFE
Analyzed
May 17, 2026, 07:34 PM
Security Audit — agent-trust-hub — convert-to-markdown