Security audit
Document Format Converter
Security checks across malware telemetry and agentic risk
Overview
The skill's code and documentation are consistent with a batch document-format converter, but it contacts an external license/verification endpoint, can push results to Feishu webhooks, and writes a local cache — review network endpoints and config before use.
This package appears to do what it says (format conversion), but before installing or using it: 1) Review converter.py (already included) for any additional network behavior; 2) Be aware that if you supply a token it will be POSTed to https://geo-api.yk-global.com/validate and the result cached under ~/.batch_converter_cache; do not provide sensitive production credentials unless you trust that endpoint; 3) If you enable Feishu integration, configured webhooks will receive converted files — check config.yaml before enabling; 4) The tool requires system dependencies (Tesseract, pandoc) for OCR/advanced conversions; install them in a controlled environment; 5) If handling sensitive documents, run conversions in an isolated VM/container or offline variant to avoid accidental exfiltration. If you want, I can point out exact lines in converter.py that perform network calls, caching, or webhook pushes.
VirusTotal
No VirusTotal findings
Static analysis
No suspicious patterns detected.