Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple local text case converter with no network, credential, persistence, or destructive behavior found.
Installing this skill should be low risk. It runs a local Python helper to transform text you provide, so avoid pasting sensitive text unless you are comfortable processing it locally in your agent environment.
The manifest sets language: en, which indicates a fixed language setting rather than an explicit user-selectable locale. Because the file also contains Chinese documentation later, this suggests the skill can support multiple languages but does not clearly present language choice or opt-in in its policy-facing metadata.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
# Find which converter to use
for name, func in converters.items():
if getattr(args, name):
result = func(args.text)
print(result)
return
No suspicious patterns detected.