多种格式文档转换/图片OCR

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:13 PM UTC
• Version: 1.0.2

Overview

The skill is a clearly disclosed third-party document converter, with privacy and local-file safety cautions but no evidence of hidden or malicious behavior.

Install only if you are comfortable sending selected documents and the WDANGZ_API_KEY to wdangz.com. Do not use it for contracts, financial records, credentials, personal IDs, regulated data, or confidential business files, and check the output directory because converted files may overwrite an existing file with the same generated name.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/convert.py:401

Finding

Unbounded buffering and storage of remote conversion responses

Content

View full analysis

pdf, pdfTOdocx -> docx） if 'TO' in conversion_type: type_suffix = conversion_type.split('TO')[-1].lower() else: type_suffix = conversion_type.lower() file_name = f"{name_without_ext}_{type_suffix}{target_ext}" else: # 备用：使用docId file_name = f"converted_{doc_id}{target_ext}" # 确保输出目录存在 os.makedirs(output_dir, exist_ok=True) output_path = os.path.join(output_dir, file_name) with open(output_path, 'wb') as f: f.write(response.content) ``` ### Technical Analysis The download request does not use streaming and does not impose a maximum response size. Accessing `response.content` causes the `requests` library to buffer the complete response body in process memory before it is written to disk. The so ...[truncated 1753 chars]

Remediation

View remediation

MAX_DOWNLOAD_BYTES: raise ValueError("Converted file exceeds the download limit") output.write(chunk) ``` 5. Download into a temporary file in the destination directory and atomically rename it only after successful validation. 6. Delete partial files when a timeout, size violation, or other exception occurs. 7. Validate the downloaded file's expected media type and file signature where practical. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/convert.py:425

Finding

Deterministic output path silently overwrites existing files

Content

View full analysis

pdf, pdfTOdocx -> docx） if 'TO' in conversion_type: type_suffix = conversion_type.split('TO')[-1].lower() else: type_suffix = conversion_type.lower() file_name = f"{name_without_ext}_{type_suffix}{target_ext}" else: # 备用：使用docId file_name = f"converted_{doc_id}{target_ext}" # 确保输出目录存在 os.makedirs(output_dir, exist_ok=True) output_path = os.path.join(output_dir, file_name) with open(output_path, 'wb') as f: f.write(response.content) ``` ### Technical Analysis The output filename is generated deterministically from the source filename and conversion type. The destination is then opened with mode `wb`, which creates a new file or immediately truncates an existing file at the same path. There is no collision check, user confirmation, backup, exclusive file creation, or unique-name generation. Repeating a conversion or placing an unrelated file at the predictable destination therefore causes silent data replacement. The command-line interface also accepts an output directory. The overwrite remains constrained by the filesystem permissions of the process, but any existing file writable by that account and matching the generated destination can be damaged. ### Attack Path 1. A file already exists at the predictable generated destination, such as `report_pdftodocx.docx`, in the selected output directory. 2. The user converts a source file whose name and conversion type generate that same destination. 3. The remote conversion completes and the script constructs the existing path. 4. `open(output_path, 'wb')` truncates the existing file before writing the downloaded content. 5. T ...[truncated 1020 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (11)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

��环境变量（唯一支持方式）

Windows:

powershell

# 临时设置（当前终端会话）
$env:WDANGZ_API_KEY = "你的API密钥"

# 永久设置（用户级别）
[Environment]::SetEnvironmentVariable("WDANGZ_API_KEY", "你的API密钥", "User")

Linux/Mac:

bash

# 临时设置
export WDANGZ_API_KEY="你的API密钥"

# 永久设置（添加到 ~/.bashrc 或 ~/.zshrc）
echo 'export WDANGZ_API_KEY="你的API密钥"' >> ~/.bashrc
source ~/.bashrc

---

📋 技术细节

项目	说明
API端点	https://www.wdangz.com/api/v1/convert
文件限制	单文件最大 50MB
支持格式	doc, docx, xls, xlsx, ppt, pptx, pdf, jpg, png, bmp, gif, webp
依赖	Python 3.x + requests 库

---

💡 Tip: 只需用自然语言描述你要做什么，我会自动识别转换类型！

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/convert.py (reported line 42)May include surrounding context.

python

# 敏感文件扩展名（可能包含敏感信息）
SENSITIVE_EXTENSIONS = [
    '.pfx', '.p12', '.key', '.pem',  # 证书文件
    '.env', '.credentials',  # 凭证文件
]
# =====================================

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill uses sensitive capabilities (environment variables and outbound network access) but does not declare any explicit tool scope or permissions boundary. This increases the chance of overbroad execution and weakens user visibility into the fact that local files and API credentials are involved in third-party upload operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description is entirely in Chinese and the usage guidance throughout the file assumes Chinese-language interaction, but there is no indication that users may choose another language. This can violate language/locale policy where skills should not impose a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The invocation examples include broad natural-language phrasing such as asking to convert 'this Excel' or similar everyday requests, which could cause the skill to trigger unintentionally during ordinary conversation. In this skill's context, accidental invocation is more dangerous because it may lead to unintended upload of local documents to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring and all user-facing warnings/messages are written in Chinese, and the script provides no option for users to select another language. This is a natural-language locale constraint that applies across the skill and may violate organizational language-choice policy when not explicitly justified or opt-in.

Content

No source excerpt is available for this finding.

Tainted flow: 'output_path' from os.environ.get (line 518, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/convert.py (reported line 440)May include surrounding context.

python

output_path = os.path.join(output_dir, file_name)
    
    with open(output_path, 'wb') as f:
        f.write(response.content)
    
    file_size = os.path.getsize(output_path)

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

The function exposes a skip_security_check parameter that disables all local safeguards before uploading files to a third-party conversion service. In this skill context, bypassing checks increases the chance that oversized, unsupported, or obviously sensitive files are sent off-host, creating data leakage risk despite the printed warning banner.

Content

Scanner excerpt · scripts/convert.py (reported line 450)May include surrounding context.

python

return output_path


def convert_document(file_path, description=None, conversion_type=None, output_dir=None, api_key=None, skip_security_check=False):
    """
    执行文档转换

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Documenting skip_security_check as a supported parameter normalizes disabling protections and makes accidental misuse more likely by callers or future integrators. Because this skill uploads documents to an external service, any feature that encourages bypassing safety controls meaningfully raises confidentiality risk.

Content

Scanner excerpt · scripts/convert.py (reported line 460)May include surrounding context.

python

conversion_type: 转换类型（可选，如果提供则优先使用）
        output_dir: 输出目录（默认与源文件同一目录）
        api_key: API密钥
        skip_security_check: 跳过安全检查（不推荐）
    
    返回:
        转换后的文件路径

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

This control-flow branch actually implements the bypass: when skip_security_check is true, the script skips the only file vetting before external upload. In a document-conversion skill whose main action is sending local files to wdangz.com, this makes the weakness more dangerous because the skipped checks are specifically intended to prevent sensitive or inappropriate file disclosure.

Content

Scanner excerpt · scripts/convert.py (reported line 469)May include surrounding context.

python

print_security_warning()
    
    # 安全检查
    if not skip_security_check:
        is_safe, warnings = check_file_security(file_path)
        if warnings:
            for warning in warnings:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-facing natural-language content in the manifest is entirely in Chinese, including the main description and security warnings. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.