Security audit
Security checks for vulnerabilities and agentic risk
The skill is a straightforward file converter, but it tells the agent to install missing system dependencies automatically, which should be reviewed before use.
Install only if you are comfortable with the skill using the local ConvertAgent CLI and writing converted output files. Before use, require explicit approval for any dependency installation and verify what package would be installed, from where, and with what privileges.
The trigger condition is very broad: it says to use this skill for any file conversion task or workflow needing deterministic conversion output. Overbroad routing can cause the skill to activate in contexts where local CLI execution, file writes, or dependency handling are unnecessary or unsafe, increasing the chance of unintended side effects.
The workflow tells the agent to run conversions with explicit output paths and verify artifact creation, but it does not warn users that the skill will create files and may modify the environment if dependencies are missing. Missing disclosure reduces informed consent and can surprise users with filesystem changes or package installation behavior.
The skill explicitly instructs the agent to install missing system dependencies and retry, which expands behavior from file conversion into privileged environment modification. This can lead to unauthorized package installation, system drift, larger attack surface, and abuse if a conversion request is crafted to trigger installation of risky tools or packages.
No suspicious patterns detected.
