winforms-to-qt-mapper

• Outcome: Review
• Latest audit: May 29, 2026 at 9:27 PM UTC
• Version:
  1.0.0

Overview

This looks like a local WinForms-to-Qt migration helper, but it overstates incomplete analysis and has avoidable dependency and file-write risks, so users should review it before installing.

Install only after reviewing the limitations. Treat generated analysis as best-effort, verify findings manually, run it in a sandbox or on a copy of the repository, choose a new empty output directory, and audit or update dependencies before using it on sensitive or proprietary code.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This package declares outbound/network and server-side capabilities (axios, ws, express, cors, helmet, compression) that are not clearly justified by the stated purpose of a local WinForms-to-Qt migration guidance tool. Extra network-facing functionality expands the attack surface and, if implemented, could enable data exfiltration, remote control channels, or unintended exposure of analyzed source code.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The code advertises dependency analysis but returns hard-coded dependency levels and no real circular-dependency detection. In a migration-analysis skill, this can mislead users into trusting fabricated architectural conclusions, causing incorrect refactoring decisions and missed design risks.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The complexity analyzer injects fabricated 'high_risk' and 'medium_risk' findings for every module instead of measuring actual code complexity. This creates false security and engineering signals that can waste remediation effort while hiding genuinely complex or risky code paths.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file-level description and skill positioning imply a real architecture analyzer, but major parts of the generated report are partially fabricated. Because this skill is intended to guide enterprise WinForms-to-Qt migration, deceptive output is more dangerous than in a toy/demo context: users may base migration planning, risk assessment, and testing priorities on false analysis.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The file advertises 'deep' Roslyn-based analysis, but many core routines that should extract classes, methods, symbols, operations, and architectural patterns are stubbed out or return hardcoded/default values. In a migration-analysis skill, this can cause users or downstream automation to trust incomplete or fabricated results, leading to incorrect architecture decisions, missed risky code patterns, and false confidence in migration readiness.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The code explicitly notes that custom-paint detection is not really implemented and returns simulated data, yet recommendation and testing guidance is still generated as though analysis-derived. This creates integrity issues in the generated report: users may omit validating custom rendering paths or incorrectly prioritize work because the tool presents assumptions as findings.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The script writes many files and creates directories under a user-controlled output path without validating the destination, warning about overwrite risk, or requiring confirmation. In an agent or automated workflow, a malicious or mistaken path could cause destructive overwrites of existing project files or writes into unintended locations, leading to data loss or tampering of trusted source trees.

Known Vulnerable Dependency: lodash==4.17.0 — 10 advisory(ies): CVE-2020-28500 (Regular Expression Denial of Service (ReDoS) in lodash); CVE-2021-23337 (Command Injection in lodash); CVE-2018-16487 (Prototype Pollution in lodash) +7 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: lodash==4.17.0

Known Vulnerable Dependency: moment==2.29.0 — 2 advisory(ies): CVE-2022-24785 (Path Traversal: 'dir/../../filename' in moment.locale); CVE-2022-31129 (Moment.js vulnerable to Inefficient Regular Expression Complexity)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: moment==2.29.0

Known Vulnerable Dependency: yaml==2.0.0 — 2 advisory(ies): CVE-2026-33532 (yaml is vulnerable to Stack Overflow via deeply nested YAML collections); CVE-2023-2251 (Uncaught Exception in yaml)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: yaml==2.0.0

Known Vulnerable Dependency: ejs==3.1.0 — 2 advisory(ies): CVE-2024-33883 (ejs lacks certain pollution protection); CVE-2022-29078 (ejs template injection vulnerability)

Critical

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: ejs==3.1.0

Known Vulnerable Dependency: axios==1.0.0 — 10 advisory(ies): CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars); CVE-2026-25639 (Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: axios==1.0.0

Known Vulnerable Dependency: ws==8.0.0 — 2 advisory(ies): CVE-2024-37890 (ws affected by a DoS when handling a request with many HTTP headers); CVE-2026-45736 (ws: Uninitialized memory disclosure)

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: ws==8.0.0

Known Vulnerable Dependency: express==4.18.0 — 2 advisory(ies): CVE-2024-43796 (express vulnerable to XSS via response.redirect()); CVE-2024-29041 (Express.js Open Redirect in malformed URLs)

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: express==4.18.0

Known Vulnerable Dependency: webpack==5.0.0 — 2 advisory(ies): CVE-2024-43788 (Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to ); CVE-2023-28154 (Cross-realm object access in Webpack 5)

Critical

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: webpack==5.0.0

VirusTotal

66/66 vendors flagged this skill as clean.