Textin File Converter Pro

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:36 PM UTC
• Version:
  1.0.2

Overview

This is a disclosed Textin document-conversion skill that sends user-selected files or URLs to Textin and writes the converted result locally.

Install only if you are comfortable sending the selected documents, images, or submitted URLs to Textin under your Textin account. Review the input path or URL, batch folder, and output path before running, especially for sensitive documents or files that could be overwritten.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The instructions say the source may be a local file path, a URL, or a folder path, but the rest of the documented workflow only validates local files and passes user-controlled input to shell scripts intended for file upload. This mismatch can cause unsafe handling of untrusted URL strings, leading to SSRF-like outbound fetch behavior if the helper script supports URLs, or command/argument handling mistakes and unintended network/data exposure if it does not.

External Transmission

Medium

• Category: Data Exfiltration

Content

json_files="$json_files\"$b64\""
    done

    curl -s -w "\n%{http_code}" \
      --location --request POST "$ENDPOINT" \
      --header "x-ti-app-id: $APP_ID" \
      --header "x-ti-secret-code: $SECRET_CODE" \

• Confidence: 95% confidence
• Finding: curl -s -w "\n%{http_code}" \ --location --request POST "$ENDPOINT" \ --header "x-ti-app-id: $APP_ID" \ --header "x-ti-secret-code: $SECRET_CODE" \ --header "Content-Type: appl

VirusTotal

66/66 vendors flagged this skill as clean.