Batch Format Converter
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill is largely what it says (a file converter) but it includes outbound network validation, webhook integration, local caching, and packaging inconsistencies that the user should understand before use.
Key points before installing/using: - Code and README match the advertised conversion features, but this package will attempt outbound network calls: token validation to geo-api.yk-global.com and optional Feishu webhook pushes. Only provide API keys or webhook URLs if you trust those endpoints. - The registry entry has no install script, yet there's a requirements.txt and system deps (Tesseract OCR, pandoc). You must install Python packages and system-level dependencies yourself; run in a virtualenv or isolated environment. - The tool caches validation results under your home directory (~/.batch_converter_cache). Inspect that cache if you're concerned about residual metadata. - Avoid converting highly sensitive files (password lists, private keys, personal data) until you confirm whether files or full contents are posted to remote services by the code (search for any HTTP POST of file contents or attachments). If you need confidentiality, consider running a reviewed fork locally or sandboxing the process with no network access. - Because the package source/homepage is unknown, consider reviewing the full converter.py for any code paths that upload file contents (Feishu push, telemetry) or call other remote URLs before trusting it in production. - If you want to proceed: run dependency installation in an isolated VM/container, inspect network traffic during a test run, and only enable Feishu/webhook or provide tokens when you understand what is sent.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.