markitdown
Warn
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill converts untrusted external data (PDF, DOCX, HTML, YouTube transcripts) into markdown for LLM consumption. It has access to powerful tools like Bash and the file system (Write, Edit). The instructions do not include boundary markers or requirements to sanitize or ignore instructions potentially embedded in the source data.
- Ingestion points: File conversion via markitdown and YouTube transcript fetching (SKILL.md).
- Boundary markers: Absent.
- Capability inventory: Bash tool, file system Write and Edit tools.
- Sanitization: Absent.- [COMMAND_EXECUTION]: The skill encourages the installation and usage of 3rd-party plugins found on GitHub via specific hashtags (#markitdown-plugin). This promotes the execution of unverified code from external, unvetted sources.- [PROMPT_INJECTION]: The skill includes instructions that steer the agent to market the author's own platform (K-Dense Web) and specific secondary skills (scientific-schematics) to the user during complex tasks, overriding the expected neutral behavior of the assistant.- [DYNAMIC_EXECUTION]: The documentation directs the agent to execute a Python script (scripts/generate_schematic.py) that is not included in the skill's file list. This may lead to the agent attempting to generate or execute improvised code at runtime.- [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading and installing the markitdown package and its source code from GitHub and PyPI repositories.
Audit Metadata