local-pandoc
Verdict safe, but 2 findings (2 medium), mainly prompt injection, command injection. Most recent scan 2026-02-06.
The local-pandoc skill is a straightforward documentation-only skill that provides guidance on using the pandoc command-line utility. It contains NO executable scripts, which significantly reduces its attack surface. However, two MEDIUM severity concerns exist: (1) The instructions demonstrate fetching content from URLs, which creates indirect prompt injection risks if malicious web content is processed, and (2) The lack of input validation guidance could lead to command injection vulnerabilities when user-provided filenames contain shell metacharacters. The skill also has minor documentation gaps (missing optional metadata fields). Overall, this is a relatively low-risk skill since it contains no executable code, but the instructions should be enhanced with security warnings about untrusted input and external content.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Converts Markdown files to PDF files using the pandoc command-line utility. Use when a user asks to convert a .md or markdown file to a .pdf file.
- Package
- 1 file, 2.6 KB
- SKILL.md
- 378 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Local Pandoc Conversion Skill · Basic Usage · Simple Conversion · Specifying Formats · Convert HTML to Markdown · Standalone Documents · Advanced Examples · PDF Output · Basic PDF creation · Control PDF engine and style via variables · Document Structure & Metadata · Create a document with a Table of Contents (up to level 3 headings)
Findings
MEDIUM Indirect Prompt Injection via Web Content Fetching Prompt Injectionllm
The skill instructions demonstrate that pandoc can directly fetch and convert content from URLs ('pandoc -f html -t markdown https://www.fsf.org'). This creates a transitive trust vulnerability where the agent may follow instructions embedded in untrusted web content. If a user provides a malicious URL, the fetched HTML could contain prompt injection attempts that the agent processes during conversion.
SKILL.md
```bash
# Reading from the Web
pandoc -f html -t markdown https://www.fsf.org
```MEDIUM Command Injection Risk via Unvalidated User Input Command Injectionllm
The skill demonstrates pandoc commands that accept user-provided file paths and options without any validation guidance. While no executable scripts are present, the instructions show patterns like 'pandoc input.md -o output.pdf' where both input and output paths come from user input. Without proper sanitization, malicious filenames or paths could lead to command injection (e.g., filenames containing shell metacharacters like ';', '|', '`').
SKILL.md
```bash
pandoc -o output.html input.md
```
No validation or sanitization guidance provided for user-supplied filenames.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 2.6 KB |
External hosts referenced
www.fsf.org
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/pandic-office
- Raw scan result: md-to-office-scan.json
- Badge for your README:
- Request a re-scan