File Converter
v2.1.0File format converter. Detect formats, convert between JSON/YAML/XML/CSV/Markdown, minify and prettify code. Commands: detect, json2yaml, yaml2json, csv2md.
⭐ 1· 711·6 current·6 all-time
byBytesAgain2@ckchzh
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill name/description (file format conversions) matches the provided scripts: they implement JSON/YAML/XML/CSV/Markdown conversions, minify/prettify, encoding, and file inspection. Minor incoherences: SKILL.md claims data is stored under ~/.file-converter/ but I found no code writing to that path, and there are two overlapping scripts (scripts/script.sh and scripts/convert.sh) with partly duplicated command sets which could cause confusion about which script the agent will run.
Instruction Scope
SKILL.md instructs the agent to run bundled shell scripts which operate on local files and use Python and standard Unix utilities. The scripts do not read unrelated system files, do not call external network endpoints, and do not reference credentials or other secrets.
Install Mechanism
There is no install spec (instruction-only), and the bundle includes only local shell and Python scripts. No downloads, package installs, or archive extraction are requested.
Credentials
No credentials or sensitive environment variables are required. SKILL.md lists an optional FILE_CONVERTER_DIR variable (default ~/.file-converter/), but the scripts do not appear to use or write to that directory — this is a documentation/config mismatch rather than a credential request.
Persistence & Privilege
The skill does not request permanent presence (always:false). It does not modify other skills or system-wide configuration. Agent autonomous invocation is allowed by default (normal) and not combined with other red flags.
Assessment
This skill appears to be a local file conversion toolkit and does not request credentials or make network calls. Before installing: (1) note there are two bundled scripts with overlapping commands — verify which script your agent will execute; (2) the README mentions a data directory (~/.file-converter/) but the code does not write there — if you expect persistent storage, inspect/modify the scripts; (3) there is a small bug/comment in cmd_base64_dec (it currently does not perform decoding) — test commands on non-sensitive sample files first; and (4) because the skill executes shell and Python code on files you provide, avoid running it on highly-sensitive files unless you review the scripts or run them in a sandbox.Like a lobster shell, security has layers — review code before you run it.
chinesevk974bw9dkn3vmg1fg64csgvrk182pys3latestvk97c61tnrw5nsddmppefwqv9j5837j8zproductivityvk9794e127v40bse2t7nywbsb1982r46h
License
MIT-0
Free to use, modify, and redistribute. No attribution required.