Security audit

data-format-converter-free

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a local data conversion skill, but it also asks for unrelated API, callback, and command-execution capabilities that users should review before installing.

Install only if you are comfortable reviewing each requested conversion task and keeping it local. Do not provide API keys or callback URLs for ordinary CSV, JSON, or YAML conversion, and confirm output paths before allowing writes or directory creation.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is presented as a local CSV/JSON/YAML converter, but its documentation also introduces callback URLs, API usage, and network-oriented behavior that are unnecessary for the stated purpose. This mismatch expands the apparent trust boundary and can mislead an agent or user into granting network-capable behavior and secrets access to a tool that should be purely local.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: A callback URL is context-inappropriate for a basic format conversion skill and introduces SSRF-like or data exfiltration risk if an agent is induced to send results to attacker-controlled endpoints. For a local file conversion task, asynchronous outbound callbacks materially increase attack surface without clear necessity.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The documentation adds API key setup and external service integration unrelated to the stated conversion functionality, which can cause users or agents to expose credentials unnecessarily. In a skill that otherwise performs local parsing and serialization, requesting API credentials is a red flag because it broadens privileges and creates opportunity for secret misuse or exfiltration.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The documentation is internally inconsistent: it limits some advanced conversion features as paid-only while elsewhere claiming broader capabilities such as command execution, search/filtering, API integration, and callbacks. These contradictions make it hard to determine the real behavior and can hide dangerous capabilities behind an innocuous description, increasing the chance of over-permissioning by the agent or user.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The skill description uses broad capability language without clear activation constraints, which is risky in an agent context because it can justify use of read/exec/write/glob beyond narrow conversion needs. Ambiguous scope increases the chance that the agent performs unnecessary file or command operations on attacker-influenced inputs.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The markdown does not clearly warn that conversion writes output files and may create missing paths, which can lead to unintended filesystem modification when driven by an agent. In a skill with write and exec tools available, weak disclosure around output side effects increases the risk of clobbering files or writing to attacker-chosen locations.

Static analysis

No suspicious patterns detected.