Binary To From File Converter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 1.0.1

Overview

This appears to be a real AgentPMT converter skill, but it can send file contents to a remote service, store decoded files in cloud storage, and return signed download links with limited documented controls.

Review before installing if you may convert private documents, credentials, customer data, or proprietary files. Use it only when you intend to send content to AgentPMT, keep expiration as short as possible, treat signed URLs like temporary secrets, and avoid the unpinned npx setup path unless you have reviewed or pinned the source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:272

Finding

Unpinned Third-Party Installer Creates a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 272–273
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup

Technical Analysis

The Skill instructs users or agents to invoke an npm-distributed CLI through npx and install content from the mutable AgentPMT/agent-skills source. Neither the CLI package nor the installed Skill content is pinned to a reviewed version, commit, or integrity hash.

npx may download and execute a package that is not already installed locally. Consequently, the effective installation code can change after this Skill has been audited. Compromise of the npm package, its maintainer account, the referenced repository, or a future mutable release could introduce malicious executable code or hostile Skill instructions.

The commands are presented as setup instructions rather than being executed automatically by this package. Exploitation therefore requires a user or agent to follow them.

Attack Path

1. An attacker compromises the package distribution account, upstream repository, or another mutable component used by the skills installer.
2. The attacker publishes a malicious package release or modifies the remotely retrieved Skill content.
3. A user or agent follows the setup instructions and executes the unpinned npx skills add commands.
4. npx downloads and runs the current package version, or the installer retrieves the altered Skill.
5. Attacker-controlled installation code executes with the invoking user's permissions, or malicious instructions are installed into the agent environment.

Impact Assessment

If the invoked package is compromised, attacker code could obtain the same local privileges as the user running npx. Depending on those privile ...[truncated 532 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the npm CLI to a reviewed exact version rather than relying on the latest mutable release.
• Pin installed Skill sources to an immutable release or commit identifier.
• Verify downloaded artifacts with cryptographic integrity hashes or signed provenance.
• Use a lockfile and a trusted internal package mirror where possible.
• Review installed Skill contents before activation.
• Avoid automatically running remotely downloaded setup components with elevated privileges.
• Document the exact trusted publisher, package version, repository revision, and verification procedure.

other

Error

• Location: SKILL.md:116

Finding

Sensitive File Content Is Sent to and Retained by a Remote Service by Default

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 116–155; supporting default in schema.md, lines 43–105
Vulnerability Type: Remote disclosure and retention of user-controlled file content
Risk Level: High

Vulnerable Code

SKILL.md defines remote cloud storage and temporary signed-link behavior:

markdown

##### base64-to-file
Decode a base64 string and save it as a file in cloud storage.

**Required fields:**
- `action`: `"base64-to-file"`
- `input`: Base64-encoded file content
- `filename`: Name for the created file (e.g., `"output.png"`)

**Optional fields:**
- `content_type`: MIME type for the file (default: `"application/octet-stream"`). Use the appropriate type, e.g., `"image/png"`, `"application/pdf"`.
- `expiration_days`: Number of days until the file expires, 1-7 (default: 7)

**Example:**
```json
{
  "action": "base64-to-file",
  "input": "iVBORw0KGgo...",
  "filename": "screenshot.png",
  "content_type": "image/png",
  "expiration_days": 3
}

Returns: { "file_id": "...", "filename": "screenshot.png", "content_type": "image/png", "size_bytes": 2048, "signed_url": "https://...", "signed_url_expires_in": "..." }

text

The related retention behavior is explicitly stated:

```markdown
- Files created with `base64-to-file` are stored in cloud storage and expire after the specified number of days (default 7).
- The `signed_url` returned by `base64-to-file` provides a temporary download link for the created file.

schema.md additionally makes remote storage the default:

json

"store_file": {
  "default": true,
  "description": "Store output as a file in cloud storage (recommended for file management access).",
  "required": false,
  "type": "boolean"
}

Technical Analysis

Base64 is an encoding and provides no confidentiality. An input value may represent documents, email attachments, images, credentials, private keys, ex ...[truncated 2815 chars]

Remediation

View remediation

Remediation Suggestions

• Perform base64, hexadecimal, and binary transformations locally by default; these operations do not require network or cloud-storage access.
• Require explicit, informed confirmation immediately before transmitting file content to AgentPMT.
• Clearly identify the destination service, data categories transmitted, retention period, and whether subprocessors or service logs receive the content.
• Change store_file to default to false. Require an explicit true value when remote persistence is necessary.
• Use the shortest practical expiration period rather than a seven-day default.
• Detect and warn about likely credentials, private keys, tokens, or other high-risk content before upload.
• Ensure signed URLs have short lifetimes, strong entropy, HTTPS-only transport, revocation support, and no inclusion in ordinary logs or chat transcripts.
• Document encryption in transit and at rest, tenant isolation, deletion guarantees, backup retention, logging policy, and incident-response procedures.
• Provide a deletion operation so users can revoke access and remove a stored file before its scheduled expiration.
• Restrict file-to-base64 access through ownership and authorization checks rather than relying solely on knowledge of a file identifier.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill prominently describes file-to-base64 extraction and base64-to-file creation with signed URLs, but does not clearly warn that these actions can expose raw file contents or create externally accessible download links. In this context, the missing warning is significant because the tool is explicitly designed to transform and export potentially sensitive file data, making accidental disclosure much more likely in automated agent workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The activation keywords include broad phrases such as generic encoding and binary-related terms that can cause the skill to trigger in contexts beyond the user's actual intent. In this skill's context, overbroad activation is more dangerous because the tool can expose file contents as base64 or generate downloadable signed URLs, increasing the chance of unintended data handling or exfiltration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

md

- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/binary-to-from-file-converter
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.

md

- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/binary-to-from-file-converter
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The schema states that decoded content will be saved in cloud storage with a signed download URL, which affects user data handling and access, but it provides no explicit warning about privacy, sharing, or storage implications. For markdown files, behaviors that could affect user data or system integrity should be accompanied by user-facing warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The action reads contents from a previously uploaded file in cloud storage and returns them as base64, which involves access to stored user data. The description explains functionality and file size limits but does not include a user-facing warning about data sensitivity or ensuring the correct file is being accessed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.