markdown-to-pdf
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied Markdown files and converts them to PDF using HTML as an intermediate format.
- Ingestion points:
scripts/convert.pyreads content from Markdown files provided by the user or an external source. - Boundary markers: None. The content is processed without delimiting untrusted data from the conversion logic.
- Capability inventory: The skill uses
pdfkit(wrappingwkhtmltopdf) which has the capability to read local files and execute system commands. - Sanitization: None. The Markdown parser uses the
extraextension, which allows raw HTML. The PDF generation configuration inscripts/convert.pyexplicitly sets'enable-local-file-access': ''. This combination allows an attacker to craft a Markdown file with HTML tags (e.g.,<img src="/etc/passwd">) to perform Local File Inclusion (LFI) and exfiltrate file contents into the generated PDF document. - [COMMAND_EXECUTION]: The skill relies on the execution of external system binaries to function.
- Evidence:
scripts/convert.pyinvokes thewkhtmltopdfbinary through thepdfkitlibrary to perform the HTML-to-PDF conversion.
Audit Metadata