Textin File Converter Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:24 AM UTC
• Version: 1.0.2

Overview

This appears to be a legitimate Textin document converter, but it needs Review because it uploads user documents and API credentials to a cloud service while the script follows redirects despite claiming a single fixed destination.

Install only if you are comfortable sending selected documents, image contents, source URLs, and Textin API credentials to Textin for processing. Avoid confidential or regulated files unless your organization permits that use. The maintainer should remove automatic redirect following or enforce same-origin HTTPS redirects, add clearer URL-input warnings, and prevent accidental overwrites in single-file mode.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/convert.sh:129

Finding

Cross-Origin Redirects May Disclose API Credentials and Document Contents

Content

View full analysis

&2 exit 1 fi validate_file_extension "$input" validate_file_size "$input" curl -s -w "\n%{http_code}" \ --location --request POST "$ENDPOINT" \ --header "x-ti-app-id: $APP_ID" \ --header "x-ti-secret-code: $SECRET_CODE" \ --header "Content-Type: application/octet-stream" \ --data-binary "@$input" fi ``` ### Technical Analysis The initial endpoint is constructed from the hardcoded `api.textin.com` host, but every request enables curl's `--location` option. This causes curl to follow redirects returned by the remote server without validating that the redirect destination remains on the same HTTPS origin. The credentials are supplied as custom headers: - `x-ti-app-id` - `x-ti-secret-code` Custom headers can be applied to redirect requests, including requests to a different host. Depending on the redirect status and curl request behavior, the POST body can also be resent. The body contains either the complete document, base64-encoded images, or a user-supplied source URL. Consequently, hardcoding the initial endpoint does not guarantee that `api.textin.com` is the sole outbound destination. This contradicts th ...[truncated 1724 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The code’s primary purpose does match document conversion via the Textin API. It validates file types/sizes, calls Textin endpoints, and saves converted output. However, the description claims support for both single file and batch folder conversion, while the code only accepts a single input argument and does not implement folder traversal or general batch processing. The only multi-file behavior is a special comma-separated list for image-to-pdf, which is not equivalent to batch folder conversion. Also, the declared description broadly suggests conversion between PDF, Word, Excel, PPT, and image formats, but the implemented set is limited to specific one-way conversions (for example, no ppt-to-* or pdf-to-pdf style generalized matrix). This is a meaningful description-to-behavior mismatch, though the main overall purpose is aligned.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly allows a source to be a URL, but it does not clearly warn that remote content may be retrieved and then transmitted to the third-party Textin service. This can cause unintended data handling, including fetching sensitive intranet or authenticated resources and forwarding their contents off-host, especially in an agent context where users may not realize a URL implies external retrieval plus third-party upload.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description says it supports batch folder conversion, but this script exposes only a single input argument and contains no folder traversal or directory-processing logic. The only multi-item handling is a comma-separated list for image-to-pdf, which does not match the broader batch folder capability claimed in the manifest.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes conversion of files between document and image formats, including single-file and batch folder conversion, but this script explicitly accepts an input file path or URL and posts URL strings to the API. Supporting remote URL ingestion expands behavior beyond the stated file/folder conversion scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This code performs deliberate external transmission of file contents to a remote API. In this skill's context that behavior is expected for cloud conversion, but it still represents a real security/privacy concern because sensitive local documents are exfiltrated off-host and processed by a third party.

Content

Scanner excerpt · scripts/convert.sh (reported line 121)May include surrounding context.

sh

json_files="$json_files\"$b64\""
    done

    curl -s -w "\n%{http_code}" \
      --location --request POST "$ENDPOINT" \
      --header "x-ti-app-id: $APP_ID" \
      --header "x-ti-secret-code: $SECRET_CODE" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script uploads either local file contents or user-supplied URLs to a third-party service without an explicit warning, confirmation step, or data-classification guard. In a file-conversion skill, users may reasonably provide sensitive business documents, so silent external transmission can cause unintended disclosure of confidential data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

L072 states the source may be 'a local file path, a URL, or a folder path', yet the rest of the skill description consistently describes validating local files, checking local file sizes, and invoking scripts with upload semantics for local inputs. This is an intent/documentation mismatch because the instruction expands the apparent behavior beyond the documented conversion scope without corresponding support elsewhere in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script writes decoded output directly to the user-specified path using shell redirection, with no existence check or confirmation. This can overwrite existing files or clobber important data if the output path is mistaken, especially in an automated agent context where paths may be composed dynamically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.