flashformat

Provide five repository-local format conversion scripts (yaml-to-json, json-to-yaml, markdown-to-text, json-minify, yaml-auto-fix) for offline CLI and pipeli...

Security Scan

The skill implements local, offline format-conversion scripts that match its name and description and do not request credentials or network access.

Purpose & Capability

Name/description match the included Python scripts (yaml_to_json, json_to_yaml, markdown_to_text, json_minify, yaml_auto_fix). No unrelated env vars, binaries, or configuration paths are requested.

Instruction Scope

SKILL.md instructs running the included scripts locally and explicitly avoids calling external APIs. The scripts only read input from --input/--input-file/stdin and write to stdout or a specified output file; they do not open network connections or access other system configuration.

Install Mechanism

There is no install spec; this is an instruction-and-code skill. The only runtime dependency is PyYAML (installed via pip), which is reasonable for YAML handling. No downloads or archive extraction are performed.

Credentials

The skill requests no environment variables or credentials. The code does file IO (read/write) consistent with a CLI conversion tool; no secrets or unrelated service tokens are required.

Persistence & Privilege

always is false and the skill does not modify other skills or system-wide settings. It does not persist credentials or attempt to enable itself automatically.

Assessment

This skill is internally consistent and appears to do what it claims: local text/YAML/JSON/Markdown conversions. Before installing or running: (1) review the scripts if you have concerns about reading or writing particular files — they will read any file path you pass via --input-file and write to --output-file; (2) install PyYAML from a trusted source (pip) in a controlled environment or virtualenv; (3) run the tools on non-sensitive sample data first to confirm behavior; (4) if you will add these to CI, ensure file paths and permissions are constrained so CI jobs don't expose secrets via input files. There is no evidence of network exfiltration or credential usage in the provided code or SKILL.md.

FlashFormat Local Converters

Overview

Run local format conversion directly from Python scripts under skills/flashformat-local-converters/scripts/. Avoid calling /api/v2/*; execute conversion in local shell, CI, or offline pipelines.

Quick Start

1. Install runtime dependency: python -m pip install PyYAML
2. Run any converter script with one input channel: --input or --input-file or stdin
3. Choose output mode: plain text (default) or --json
4. Optionally write result to file: --output-file <path>

Script Map

• scripts/yaml_to_json.py: Convert YAML to JSON, support --indent and --compact
• scripts/json_to_yaml.py: Convert JSON to YAML, support --sort-keys and --compact
• scripts/markdown_to_text.py: Strip Markdown syntax into readable text
• scripts/json_minify.py: Minify JSON to one-line payload
• scripts/yaml_auto_fix.py: Apply conservative YAML whitespace/indent fixes with validation

Unified CLI Contract

• Input priority: --input > --input-file > stdin
• Output target: stdout by default, or --output-file
• JSON mode payloads: {"ok": true, "tool": "...", "output": "..."} {"ok": false, "tool": "...", "error": "..."}
• Plain mode failures write error text to stderr and return non-zero exit code

Usage Examples

• YAML to JSON: python skills/flashformat-local-converters/scripts/yaml_to_json.py --input-file in.yaml --output-file out.json
• JSON to YAML (sorted keys): python skills/flashformat-local-converters/scripts/json_to_yaml.py --input '{"b":2,"a":1}' --sort-keys
• Markdown to text (stdin pipeline): cat draft.md | python skills/flashformat-local-converters/scripts/markdown_to_text.py
• JSON minify with structured output: python skills/flashformat-local-converters/scripts/json_minify.py --input-file data.json --json
• YAML auto-fix: python skills/flashformat-local-converters/scripts/yaml_auto_fix.py --input-file broken.yaml --indent-step 2 --fix-tabs --fix-odd-indent

References

Read references/io-contracts.md when exact options, error messages, and backend logic mapping are needed.