md-to-office

Pass

Audited by Gen Agent Trust Hub on Mar 9, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes subprocess.run to call the Pandoc binary. Arguments are passed as a list rather than a single shell string, which is a security best practice that prevents shell injection attacks.\n- [EXTERNAL_DOWNLOADS]: The documentation includes installation instructions for Pandoc and its Python wrapper pypandoc. These tools are fetched from well-known and trusted sources, including system package managers (Homebrew, APT, Chocolatey) and the PyPI registry.\n- [DATA_EXFILTRATION]: No evidence of unauthorized data access or network transmission was found. The skill documentation includes placeholders (e.g., YOUR_API_KEY) for sensitive information within templates, which is a safe and standard practice.\n- [PROMPT_INJECTION]: The instructions and metadata are strictly focused on document conversion tasks and do not contain any patterns intended to bypass safety filters or override agent behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 9, 2026, 08:21 AM