Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a file converter, but it asks for broader command, network, and credential-related authority than the conversion task clearly needs.
Review before installing. Use this only if you are comfortable granting local read/write/glob plus command execution to a conversion helper, and avoid using callback_url, API keys, or sensitive files unless the agent asks for clear confirmation and explains exactly what will be sent or overwritten.
The documentation explicitly advertises command execution in a skill whose business purpose is simple file-format conversion. In practice, this unjustified capability materially increases risk because an agent may invoke shell commands under broad user prompts, enabling abuse well beyond intended functionality.
Several metadata and description lines emphasize '中文输出' / Chinese output support, but the document does not offer a language selection mechanism or state that Chinese output is optional. SQP-3 applies to natural-language locale policy issues when a skill appears to impose a specific language without user opt-in.
The skill introduces a callback_url parameter and implies network-capable behavior even though its stated purpose is local data-format conversion. That scope expansion can cause unexpected outbound data transmission and increases attack surface without clear user justification or controls.
Adding callback URL support to a basic format converter introduces unnecessary outbound network behavior. This is especially risky because users may provide sensitive file contents for conversion and not expect any data or metadata to be transmitted externally.
The callback URL feature is presented without a privacy warning, despite the possibility of sending status or converted data to external endpoints. For a converter handling potentially sensitive local files, silent network transmission materially changes the privacy expectations and risk profile.
The invocation scope is broad and underspecified, describing generic data-conversion behavior without clear trigger conditions, exclusions, or limits. In an agent system, overly broad scope can cause the skill to activate on inappropriate tasks and apply powerful read/write/exec capabilities in contexts the user did not intend.
Documenting API key configuration for a local conversion skill suggests hidden or unnecessary reliance on external authenticated services. This can mislead users into exposing secrets to a workflow that should not need them and increases the likelihood of credential mishandling.
The skill describes writing output files and creating paths without clearly warning that local files may be created or overwritten. In agent-driven environments, this can lead to unintended modification of user data or writing into sensitive locations when paths are derived from prompts or inputs.
The documentation claims external API integration despite the skill being described as a local format converter. This mismatch can normalize unnecessary network access and authenticated service usage, creating opportunities for data exfiltration or secret misuse.
Claiming command-execution capability for a simple converter is dangerous because it broadens the skill from data transformation into arbitrary system interaction. In an agent environment with exec tooling, ambiguous permission to run commands can be leveraged to read sensitive files, alter the system, or chain with other capabilities.
The FAQ intends to contrast safe and unsafe YAML parsing, but the text says to use yaml.safe_load() rather than yaml.safe_load(), which is self-contradictory. This actively undermines the stated security guidance about refusing arbitrary Python object execution.
