Security audit
Security checks for vulnerabilities and agentic risk
The converter fits its stated purpose, but its discard-text option can leave confidential text in shared presentation notes.
Do not rely on --prose skip to remove confidential text; inspect and remove presentation notes before sharing. Remove remote image links for offline documents, use an approved Omni parsing service for sensitive files, and install reviewed dependency versions.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
if one and ":" not in one and decls:
rules.append((one, decls))
i = j
return rules
_COMPOUND_RE = re.compile(r"^(?:([a-zA-Z][\w-]*))?((?:\.[\w-]+)*)?(?:#([\w-]+))?$")
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The documented npx skills add huhoo/cue-awesome --skill omni2docx command can download and execute an unpinned npm package and install skill content from a mutable repository reference. A compromised upstream release or repository could therefore introduce malicious code or agent instructions during installation. Although the detector incorrectly describes npx skills as an MCP server, the underlying installation supply-chain risk is real; nothing in this README demonstrates malicious intent.
The installation command invokes an unpinned npm CLI through npx skills and installs skill content from a repository without an immutable revision. Although the finding incorrectly describes this CLI as an MCP server, the underlying supply-chain risk is real: changed or compromised upstream content could execute with the installing user's permissions or introduce malicious agent instructions.
The README recommends Omni Reader parsing for scanned documents and multi-source legal evidence without explicitly warning that source content may be transmitted to the configured parsing service. Its local-conversion assurance and discussion of parsing costs do not establish a privacy boundary or consent requirement, creating a disclosure risk for sensitive legal and financial material; the supplied file does not establish the service's actual deployment or retention practices.
Without declared permissions the skill's intent is opaque and cannot be validated.
Untrusted Markdown can supply HTTP or HTTPS image URLs that are preserved in the generated HTML, causing automatic network requests when a recipient opens it or the headless browser exports a PDF. This enables document-view tracking and requests to network endpoints accessible from the viewer or rendering environment, contradicting the self-contained output promise; attribute escaping does not prevent these requests.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
return False, "未找到 headless 浏览器（Edge/Chrome/Chromium），跳过 PDF"
url = "file:///" + os.path.abspath(html_path).replace("\\", "/")
try:
subprocess.run([browser, "--headless", "--disable-gpu", "--no-pdf-header-footer",
"--print-to-pdf=%s" % os.path.abspath(pdf_path), url],
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=120)
except Exception as e:
The CLI accepts --prose=skip, but neither call to build() forwards args.prose, so rendering uses the default prose="notes" and retains body text in speaker notes instead of discarding it. In a document-to-presentation workflow, users could unknowingly distribute confidential source text inside an apparently sanitized deck; speaker notes are recoverable by recipients.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
print("\n" + "#" * 72)
print("# SUITE:", suite)
print("#" * 72)
rc = subprocess.run([PY, str(HERE / suite)]).returncode
if rc != 0:
failed.append(suite)
print("\n" + "=" * 72)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
md = OUT / (name + ".md")
htm = OUT / (name + ".html")
md.write_text(md_text, encoding="utf-8")
r = subprocess.run([PY, "-B", RENDER, "--md", str(md), "--out", str(htm)],
capture_output=True, text=True)
if r.returncode != 0 or not htm.is_file():
raise SystemExit("3 取值域故障：render_html 没出件（%s｜rc=%d｜%s）"
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(cmd):
return subprocess.run([PY] + cmd, capture_output=True, text=True,
encoding="utf-8", errors="replace")
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
docx_out = OUT / f"t_{case_id}.docx"
cmd = [PY, BUILD, "--json", str(tmp_json), "--out", str(docx_out),
"--profile", profile] + extra
r = subprocess.run(cmd, capture_output=True, text=True,
encoding="utf-8", errors="replace")
rec["build_rc"] = r.returncode
if r.returncode != 0:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
results.append(rec)
print(f"[BUILD FAIL] {case_id}: {rec['err']}")
continue
v = subprocess.run([PY, VALID, "--json", str(tmp_json), "--docx", str(docx_out)],
capture_output=True, text=True, encoding="utf-8",
errors="replace")
val_ok = v.returncode == 0
The renderer hard-codes <html lang="zh-CN"> and a Chinese fallback title, with other generated labels such as the table of contents and notes also fixed in Chinese. This applies even to non-Chinese source documents, and the available arguments provide no locale choice or documented region-specific justification.
The module documentation at L008–L010 states that validation is determined by CJK character coverage of at least 99%, with structural checks being informational. However, L180–L189 also make rounded corners, shadows, color counts, missing CJK fonts, and contrast independent failure conditions, so an HTML document with complete source coverage can receive FAIL and exit status 1.
No suspicious patterns detected.