Annotation Format Converter
ReviewAudited by ClawScan on May 10, 2026.
Overview
The converter mostly matches its stated purpose, but a crafted COCO file could make it write label files outside the chosen output folder.
Treat this as a useful local converter, not as malware, but avoid running it on annotation files from untrusted sources until the path handling is fixed. Use a temporary output folder, review generated files, and install dependencies in a virtual environment.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Converting a malicious or untrusted COCO file could overwrite or create .txt files outside the intended output folder, within the permissions of the running user.
The output path is built from file_name values inside the COCO JSON. If an untrusted COCO file contains path components such as ../, the converter can write outside the requested output_dir.
img_name = img_info.get('file_name', f'{img_id}.jpg') ... base_name = os.path.splitext(img_name)[0]
output_path = os.path.join(output_dir, f"{base_name}.txt")
with open(output_path, 'w') as f:Only run the converter on trusted annotation files and use a disposable output directory. The maintainer should sanitize file_name with a basename-only policy, resolve paths, verify outputs stay inside output_dir, and avoid overwriting existing files without confirmation.
Following the setup command installs the latest available packages, which may differ over time or conflict with the user's Python environment.
The setup instructions install unpinned third-party packages from PyPI. This is normal for a Python utility, but it leaves the exact installed versions and provenance to the user's environment.
pip install pillow tqdm
Install in a virtual environment and pin trusted package versions. The skill maintainer should add a clear install spec or requirements file with version constraints.