html-to-markdown-converting-html
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted HTML data from files or remote URLs (using the
--urlflag). This creates a surface for indirect prompt injection if the source content contains malicious instructions intended to influence an agent reading the converted Markdown output. - Ingestion points: Processes HTML from local files (stdin/FILE) or remote URLs specified via the
--urlparameter inreferences/cli-reference.md. - Boundary markers: The skill converts input to standard Markdown/Djot/Plain text but does not include explicit instructions for agents to ignore embedded commands in the output.
- Capability inventory: The conversion logic is implemented in Rust, Python, and Node.js. The tool can fetch remote data, write to local files, and execute shell completions.
- Sanitization: The skill provides preprocessing flags (
--preprocess,--strip-tags,--exclude-selectors) to remove potentially dangerous or noisy HTML elements like scripts, forms, and navigation before conversion. - [EXTERNAL_DOWNLOADS]: The documentation provides multiple methods for installing the tool from external sources, including Homebrew, npm (pnpm), PyPI (uvx), and Crates.io (cargo).
- Evidence: Instructions in
references/cli-reference.mdsuggestbrew install xberg-io/tap/html-to-markdown,pnpm dlx @xberg-io/html-to-markdown-cli, andcargo install html-to-markdown-cli. - [COMMAND_EXECUTION]: The skill involves the execution of shell commands to perform conversions and manage the CLI tool.
- Evidence:
SKILL.mdandreferences/cli-reference.mdprovide numerous examples of bash commands for file processing, piping stdin, and tool configuration. - [REMOTE_CODE_EXECUTION]: The skill uses tools like
pnpm dlxanduvxwhich fetch and execute code from remote registries at runtime. - Evidence:
pnpm dlx @xberg-io/html-to-markdown-cli --helpanduvx --from html-to-markdown html-to-markdown --helpare documented inreferences/cli-reference.md.
Audit Metadata