markitdown
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs
uv, a widely recognized and trusted Python package manager, from its official domain (astral.sh). - [EXTERNAL_DOWNLOADS]: The skill downloads the
markitdowntool, which is an official open-source project from Microsoft, using theuvpackage manager. - [COMMAND_EXECUTION]: The installation script (
install.sh) and helper script (scripts/mdconvert.sh) execute shell commands to manage directories, copy files, and invoke themarkitdownCLI. These operations are limited to the intended functionality of installing and running the file conversion tool. - [DATA_EXFILTRATION]: While the skill processes user files, the analysis confirms that data is processed locally using the
markitdownCLI. The skill explicitly warns the user inSKILL.mdandREADME.mdabout the potential for sensitive information to be present in conversion outputs and advises against external sharing.
Audit Metadata