Security audit

Web To Fim

Security checks across malware telemetry and agentic risk

Overview

The skill clearly aims to convert user-provided web or local content into Markdown and save it to Obsidian, Feishu, and Tencent IMA, with the main artifact disclosing those data transfers and controls.

Install only if you want content you choose to be stored in all configured destinations. Do not run it on confidential files, private URLs, or regulated data unless Feishu and Tencent IMA storage is approved; use --no-feishu, --no-ima, --no-obsidian, or --dry-run when you only want conversion or a subset of destinations. Verify which Feishu account lark-cli is logged into and pin/update Python dependencies in managed environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill documentation describes capabilities to read local files, write to the Obsidian vault and temporary files, make network requests to third-party services, access environment variables, and invoke subprocesses such as lark-cli. If the platform relies on an explicit permission manifest and none is declared, users and enforcement layers may not understand or constrain the real access the skill requires, enabling broader-than-expected file access, data exfiltration, and shell execution.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The module is labeled deprecated and 'do not use,' yet it still exposes a working CLI that can create cloud documents and transmit content. This mismatch increases the chance that operators or downstream automation invoke an unsupported path with weaker review, stale auth handling, or outdated storage behavior.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger language is broad enough that the skill may activate on loosely related requests involving URLs or files, increasing the chance of unintended exfiltration or storage actions. In this skill's context, accidental invocation is more dangerous because it can move user-provided content to multiple external destinations, including cloud services.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README emphasizes one-click conversion and storage to Obsidian, Feishu, and Tencent IMA without a prominent warning that local files and fetched web content may be transmitted to third-party services. This is dangerous because users may provide sensitive documents or internal URLs without realizing the skill will upload or retain them across multiple systems.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger condition states that the skill should activate when a user provides any URL or local file and asks to save it as a document, which is broad for a skill that performs local writes and cloud uploads. In a multi-skill agent environment, this can cause unintended invocation on loosely related requests and lead to accidental exfiltration of local files or unexpected persistence to Obsidian, Feishu, and IMA.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger word list includes broad phrases like '转文档', '网页转文档', and 'url转文档' without constraints distinguishing simple format conversion from sensitive storage actions. Because this skill writes locally and uploads remotely, overly generic triggers increase the chance that ordinary document-conversion requests are routed into a workflow that stores data in external systems.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README highlights one-click conversion and storage to a local Obsidian vault plus two cloud destinations, but it does not prominently warn that using the skill may copy potentially sensitive webpage or local-file contents into persistent local and remote systems. This is especially risky because supported inputs include arbitrary local files, so users may not appreciate that confidential documents could be uploaded to Feishu and IMA and retained beyond the immediate task.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list contains broad natural-language phrases such as 'url转文档', '文件转飞书', '存到ima', and '存到obsidian' that can plausibly appear in ordinary conversation. Because this skill performs file reads, local writes, network fetching, and uploads to cloud services, accidental invocation could cause unintended processing or exfiltration of user content to Obsidian, Feishu, or Tencent IMA.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The import_urls method forwards arbitrary user-supplied URLs to Tencent IMA for server-side fetching, which can expose private, sensitive, or internal-only links to a third party without an explicit warning at the operation point. In this skill's context, the whole feature is designed to ingest external and possibly local-origin content into multiple remote systems, so the privacy and data-boundary risk is higher than in a generic API client.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests python-dotenv
Confidence: 95% confidence
Finding: The dependency `requests` is unpinned, so installs may pull different versions over time, including versions with known security defects or breaking behavior. In a skill that fetches arbitrary web content and may process attacker-controlled URLs, dependency drift increases supply-chain and runtime risk because networking behavior is security-sensitive.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests python-dotenv
Confidence: 91% confidence
Finding: The dependency `python-dotenv` is unpinned, which allows uncontrolled version changes during installation. Although lower risk than a network library, this still creates supply-chain uncertainty and may introduce vulnerable or incompatible releases into environments handling local files and secrets.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 97% confidence
Finding: `requests` is flagged with multiple known advisories, and because this skill retrieves arbitrary remote content, any flaw in URL handling, redirect processing, TLS/session behavior, or credential use is especially relevant. The skill context makes this more dangerous than a typical app because it actively consumes untrusted URLs from many sources, increasing exposure to SSRF-like abuse, credential leakage, or man-in-the-middle related failures depending on the installed version.

Known Vulnerable Dependency: python-dotenv — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

Category: Supply Chain
Confidence: 78% confidence
Finding: `python-dotenv` is associated with advisories including symlink-following and possible unsafe file write behavior in `set_key`, which can matter if the skill manipulates `.env` files or runs in a shared filesystem context. Given this skill stores content across multiple locations and may operate on local files, filesystem safety issues are relevant, though impact depends on whether vulnerable APIs are actually used.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.