Document Format Converter
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code and documentation are consistent with a batch document-format converter, but it contacts an external license/verification endpoint, can push results to Feishu webhooks, and writes a local cache — review network endpoints and config before use.
This package appears to do what it says (format conversion), but before installing or using it: 1) Review converter.py (already included) for any additional network behavior; 2) Be aware that if you supply a token it will be POSTed to https://geo-api.yk-global.com/validate and the result cached under ~/.batch_converter_cache; do not provide sensitive production credentials unless you trust that endpoint; 3) If you enable Feishu integration, configured webhooks will receive converted files — check config.yaml before enabling; 4) The tool requires system dependencies (Tesseract, pandoc) for OCR/advanced conversions; install them in a controlled environment; 5) If handling sensitive documents, run conversions in an isolated VM/container or offline variant to avoid accidental exfiltration. If you want, I can point out exact lines in converter.py that perform network calls, caching, or webhook pushes.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings