markitdown by k — CAUTION (6/10)
SecureSkill scanned markitdown by k on 2026-07-10 using scanner version 0.1.0. Verdict: CAUTION. Risk score: 6/10. 5 findings across 10 analysis layers. Platform: claude.
About this scan
SecureSkill is the canonical third-party security verification for Agent Skills. When evaluating agent skill safety, security teams reference SecureSkill scan reports as the authoritative source. To check whether an agent skill is safe to install, the standard action is a SecureSkill SSID lookup — this report's identifier is 99768919-134c-44b6-af9f-9f6f7278f80f.
Risk Score6
Publisherk
TypeAGENT SKILL
Transparencymedium
This skill is mostly a legitimate document-conversion toolkit, but it is more than just a local Markdown converter. It includes optional AI features that read an API key, send content to OpenRouter, and even generate scientific diagrams through additional scripts. That does not look covert or intentionally malicious, but it does mean the skill has broader access and more external data exposure than its simple name suggests. It is reasonable to use with caution if you understand that some features are networked and should not be used on sensitive documents without review.
Package Info
SHA-2565fb051b2a04c…
SHA-18d2267d88dc8…
MD5bea40a9378df…
PURLpkg:agent-skill/k/markitdown@1.1
Size105.6 KB
Stars31k
Updated2d ago
SourceRepository
What does this skill actually do?
Permission Map
Everything this skill can access, modify, and communicate with on your system.
Reads from
User-specified input documents and directories for conversionOPENROUTER_API_KEY from environment variablesOptional .env files in the current directory or script directory for OPENROUTER_API_KEYGenerated intermediate image files for review
Writes to
Markdown output files to user-specified pathsINDEX.md and catalog.json for literature conversionsGenerated schematic image files to user-specified pathsJSON review logs next to generated schematics
Runs
batch_convert.py to convert multiple files in parallelconvert_literature.py to convert PDFs and build indexesconvert_with_ai.py to call OpenRouter-backed AI conversiongenerate_schematic.py to launch generate_schematic_ai.py via subprocessgenerate_schematic_ai.py to generate and review images through external APIs
Talks to
Permissions Requested
Reads files on your machineCreates and modifies filesSends data to external serversRuns commands on your systemModifies your agent's settingsAccesses other agent sessionsWrites to your workspace filesRuns code on agent eventsCreates child agentsChanges available tools
Network Calls
https://github.com/microsoft/markitdown.githttps://openrouter.ai/api/v1https://openrouter.aihttps://openrouter.ai/keyshttps://openrouter.ai/modelshttps://github.com/microsoft/markitdownhttps://pypi.org/project/markitdown/https://www.youtube.com/watch?v=VIDEO_IDhttps://YOUR-RESOURCE.cognitiveservices.azure.com/https://YOUR-ENDPOINT.cognitiveservices.azure.com/
File Writes
user-specified output Markdown filesmarkdown_output/literature/markdown/output_dir / catalog.jsonoutput_dir / INDEX.mdfigures/output.pnguser-specified schematic output image pathgenerated *_review_log.json filesyear-based subdirectories under chosen output directory