Security audit

数据格式转换器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward data format conversion guide, with ordinary local file reading and writing risks that users should control explicitly.

Install only if you are comfortable letting the agent read source data files and write converted outputs. Avoid using callback_url unless you trust the endpoint and know what will be sent, and specify a fresh output directory or confirm overwrite behavior before batch conversions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises a callback_url parameter for asynchronous completion but does not clearly warn that converted data, metadata, or job results may be transmitted to an external endpoint. In a data-conversion context, users may provide sensitive files, so silent or poorly disclosed outbound transmission creates a meaningful data exfiltration and privacy risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The batch conversion guidance describes creating output directories and writing converted files without prominently warning about file creation, overwrite behavior, or destination safety. In an agent setting with read/write/exec tools, unclear write semantics can lead to accidental data loss, overwriting of important files, or unsafe writes into unintended paths.

Static analysis

No suspicious patterns detected.