Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward document-to-Markdown parsing helper, with remote URL parsing disclosed but worth using carefully for sensitive documents.
Install only if you expect agents to parse documents with miaoda-studio-cli. Avoid sending confidential files or sensitive URLs through it unless you trust the configured document parsing service and understand where the content will be processed.
The trigger list is very broad and includes generic phrases such as reading documents, extracting content, and parsing common office files. This can cause the skill to activate for many ordinary requests and route users into a document-processing path that may ingest local files or remote URLs unnecessarily, increasing the chance of unintended data exposure or over-collection.
The documentation explicitly permits --file to be a URL and shows remote fetch examples, but it does not warn that the tool will retrieve external content for processing. That omission can lead to silent network access, unexpected transfer of sensitive URLs or documents to the parsing backend, and possible abuse for fetching untrusted remote content.
Most of the skill documentation and invocation guidance are written only in Chinese, while also mixing a few English trigger phrases, without stating that the skill is intentionally Chinese-only or offering a user language choice. This can create a locale-policy issue if the organization expects language neutrality or user opt-in for language constraints.
