TokenFlow 词元流

• Outcome: Pass
• Latest audit: May 28, 2026 · 8:21 AM UTC
• Version: 1.0.0

Overview

TokenFlow is a disclosed remote file and URL conversion skill, but users should understand that documents, URLs, and optional sign-in credentials are sent to TokenFlow's service.

Install only if you are comfortable sending supported attachments and pasted URLs to TokenFlow for remote processing. Review config.json first, set askEachTime=true or action=skip for sensitive file types, avoid private/internal URLs, and prefer an existing API key over entering passwords on the command line.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger list includes generic natural-language phrases such as "convert file" and "make it flow," which can match ordinary user requests and cause the skill to activate unintentionally. In this skill, unintended activation is more dangerous because activation can result in files or pasted URLs being sent to an external service, creating privacy and data handling risks.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The overview and behavior sections describe automatic conversion of files and URLs through a remote API, but the skill does not prominently warn users that attached files and pasted URLs are transmitted off-platform to a third-party service. Because the skill is designed to process potentially sensitive documents, lack of clear disclosure undermines informed consent and can lead to accidental exfiltration of confidential data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The configuration instructions show API keys stored in config files and environment variables, but do not clearly warn about the sensitivity of those credentials or the risks of storing them in plaintext. This can lead users to commit keys to repositories, share skill directories, or use insecure filesystem permissions, resulting in credential exposure and unauthorized API use.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation instructs users to pass passwords directly on the CLI and states that an API key will be saved automatically, but it does not warn about shell history, process-list exposure, or secure storage requirements. This can lead to credential disclosure on shared systems or through local logs and history, especially because the skill is explicitly handling account sign-in and persistence of authentication material.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The convert() method uploads arbitrary file contents to an external service, but this client code does not enforce any disclosure, consent, or trust boundary checks before transmission. In an agent-skill context, that is dangerous because users may assume attached files are processed locally while sensitive documents are actually exfiltrated to a third-party endpoint.

Missing User Warnings

Low

• Confidence: 72% confidence
• Finding: The convertUrl() method sends user-supplied URLs to a remote conversion service without any built-in disclosure or confirmation. While lower impact than direct file upload, it still exposes browsing targets or internal URLs to a third party and may surprise users in an agent environment.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The signup() flow transmits email and password to a remote authentication endpoint without any user-facing warning in this code path. In a skill context, collecting credentials for a third-party service can create phishing-like risk and unexpected credential disclosure if users do not clearly understand they are authenticating against an external provider.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The signin() method sends credentials to a remote service and then persists the returned API key via saveConfig(), but the code shown provides no user disclosure, consent, or secure-storage guarantees. In an agent setting this increases risk because users may unknowingly hand over credentials and create a long-lived local secret that could be exposed by weak storage practices.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases include generic language like "convert file" and especially "make it flow," which can collide with ordinary user conversation and invoke the skill unexpectedly. In this skill, accidental invocation is more dangerous because activation can lead to attached files or pasted URLs being sent to a third-party service, creating unintended data disclosure.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill overview describes conversion functionality but does not prominently warn that attached files and pasted URLs are transmitted to the external TokenFlow API. This is dangerous because users may provide sensitive documents or internal links without realizing their contents will leave the local agent environment and be processed by a remote service.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to pass email and password directly on the command line for signup/signin. Command-line credentials can be exposed through shell history, process listings, terminal logging, or auditing tools, which can leak secrets to other local users or monitoring systems. In a skill install/authentication context, this is more dangerous because users are likely to copy-paste the commands verbatim.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The client unconditionally uploads the provided file to a third-party remote service at /convert, but this code does not provide any user-facing disclosure or consent mechanism at the point of transmission. In an agent/skill context, users may assume files are processed locally, so sensitive document contents could be exfiltrated to an external service without informed consent.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The convertUrl method sends user-supplied URLs to the remote TokenFlow service without any in-band warning or confirmation. While lower impact than raw file upload, submitted URLs can still reveal sensitive internal resources, private document locations, or browsing intent to the external service.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The signup flow transmits email and password to a remote endpoint and then persists the returned API key locally via saveConfig, but there is no visible notice here about remote credential handling or local secret storage. In an agent skill, this can surprise users and increase risk of credential misuse or token exposure on shared systems.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The signin flow similarly sends credentials to a remote service and stores the API key locally without explicit user-facing disclosure in this code path. This is risky in skill environments because users may not expect persistent secret storage or understand that authentication data is leaving the local environment.

Static analysis

No suspicious patterns detected.