Doc Format Converter

Doc Format Converter — Convert between CSV, Excel, JSON, PDF, Markdown, DOCX, HTML, and images with one click. Batch processing supported. Triggers: format c...

Security Scan

The skill largely matches a document-conversion tool, but there are multiple inconsistencies around billing/credentials, declared requirements, and SKILL.md vs. code that merit review before installing.

Purpose & Capability

The code and SKILL.md implement a file conversion engine (pandas, Pillow, PyMuPDF, python-docx, pandoc fallbacks) which is consistent with the stated purpose. However the registry metadata lists no required environment variables or binaries while the SKILL.md and included billing.py clearly require SKILL_BILLING_API_KEY, SKILL_BILLING_SKILL_ID and FEISHU_USER_ID and the requirements.txt implies native tools (e.g., tesseract/pandoc) may be needed. This mismatch between declared metadata and actual needs is concerning.

Instruction Scope

SKILL.md and billing.py instruct the runtime to transmit FEISHU_USER_ID and billing requests to a third-party endpoint (https://skillpay.me/api/v1/billing). The conversion code itself operates on local files only, but SKILL.md also references Feishu notifications (no Feishu integration code present in the bundle). A sample in SKILL.md calls check_quota_free, but the provided billing.py does not define that function, indicating instructions and code are not fully aligned.

Install Mechanism

No install spec (instruction-only install) and no remote downloads; files are bundled in the skill. requirements.txt lists several Python packages which are expected for the functionality. No high-risk external URL downloads are present.

Credentials

The skill uses and documents three sensitive environment values (SKILL_BILLING_API_KEY, SKILL_BILLING_SKILL_ID, FEISHU_USER_ID) but the registry metadata lists none. The FEISHU_USER_ID is sent to an external billing API — reasonable for billing but should be declared explicitly. Also requirements imply OCR (pytesseract) and pandoc which typically need system binaries; those system dependencies are not declared.

Persistence & Privilege

The skill does not request always:true, and it does not modify other skills or system settings. It will, however, perform network calls to the billing service during execution if API key is present.

What to consider before installing

Key issues to resolve before installing: - Metadata mismatch: the registry claims no env vars but SKILL.md and billing.py require SKILL_BILLING_API_KEY, SKILL_BILLING_SKILL_ID and FEISHU_USER_ID. Ask the publisher to correct the registry metadata so you know what secrets will be used. - Billing endpoint: the skill will POST user_id and charge data to https://skillpay.me. Confirm you trust that endpoint and understand that FEISHU_USER_ID will be transmitted for billing. - Instruction vs code mismatch: SKILL.md references functions (check_quota_free) and Feishu integration that are not present or not obviously implemented. Ask for a clear mapping of how billing/quota checks work and for the Feishu push code if the feature is advertised. - Undeclared system dependencies: OCR (pytesseract) and pandoc often require native binaries. Confirm whether the runtime provides tesseract/pandoc or if they will be installed, and whether those installs are safe. - Billing behavior: billing.py treats API-key-absent or API failures as a developer-mode success (returns large balance). This is a design choice but may mask network failures and could lead to unexpected free usage; request clarification. If you decide to proceed, only provide billing API keys and FEISHU_USER_ID if you trust the publisher and runtime, and consider running the skill in an isolated environment (sandbox) while you validate its behavior.

Batch file format conversion: CSV ↔ Excel ↔ JSON ↔ PDF / Markdown / DOCX / HTML / PNG / TXT — one-click batch conversion.

---

Features Overview

Feature	Description
Multi-format	CSV, Excel, JSON, PDF, Markdown, DOCX, HTML, PNG/JPG, TXT
Batch Processing	Convert multiple files in one execution
AI Custom Conversion	Rename fields, extract tables, restructure data (PRO)
Feishu Integration	Conversion complete → Feishu card notification

---

Supported Conversions

Source	Targets
CSV	Excel (.xlsx), JSON
Excel (.xlsx/.xls)	JSON, CSV, PNG (table image)
JSON	Excel (multi-sheet)
Markdown	DOCX, HTML
DOCX	Markdown
HTML	Markdown
PDF	PNG/JPG (image)
Image (PNG/JPG)	PDF
TXT	CSV

---

Tiered Features

Feature	FREE	PRO
Total files	10 (lifetime)	Unlimited
Batch size	5 files	Unlimited
Formats	Basic	All
AI custom conversion	—	Yes
PDF OCR	—	Yes
Feishu result push	—	Yes

---

Technical Implementation

Category	Technology
Spreadsheet	pandas (CSV/Excel/JSON)
PDF	PyMuPDF + pdfplumber
Document	pandoc + python-docx
Image	Pillow (PIL)
Encoding	UTF-8/GBK/ISO auto-detect

---

Usage

Standard Conversion

Convert these files:
[upload file list]
Target format: XLSX

AI Custom Conversion (PRO)

Rename fields in this CSV to English, then convert to JSON
Extract tables from this DOCX into Excel, convert other content to Markdown

---

Core Script

See scripts/converter.py for full implementation:

from scripts.converter import batch_convert, check_quota_free

# Free tier: check before converting
can_proceed, msg = check_quota_free(remaining=7)
if not can_proceed:
    print(msg)
    sys.exit(1)

# Batch conversion
results = batch_convert(
    file_paths=["data.csv", "report.xlsx"],
    target_format="json",
    output_dir="/tmp/output",
    plan="FREE",
)
print(results)

---

Billing

• Pay-per-call: $0.0100 USDT per execution via SkillPay.me
• Balance insufficient: Payment URL returned — user tops up at https://skillpay.me/doc-format-converter
• External data flow: FEISHU_USER_ID transmitted to skillpay.me/api/v1/billing for billing identification
• Billing model: Each batch conversion run = 1 call = $0.0100 USDT

---

Required Environment Variables

Variable	Description
FEISHU_USER_ID	User open_id for billing (passed by Feishu runtime)
SKILL_BILLING_API_KEY	SkillPay Builder API Key
SKILL_BILLING_SKILL_ID	SkillPay Skill ID (defaults to doc-format-converter)

---

Error Handling

Error Type	Handling
Encoding error	Auto-try UTF-8 → GBK → ISO-8859-1
Unsupported format	Friendly error + suggested formats
Corrupted file	Skip and report, continue to next
Quota exceeded	Card prompts upgrade option