Security audit

pandoc-con组合包

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a document/productivity bundle, but it gives conflicting local-only versus API/credential guidance that users should review before installing.

Review this before installing if you expect a strictly local pandoc converter. Only provide API keys or route documents through APIs if you understand which service is being called and what content is sent. Use the skill on copies of files or scoped folders, and avoid broad command execution on untrusted documents.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest presents this as a local productivity/document-conversion bundle, but later documentation introduces API integration and external service interaction that are not aligned with the declared capability model. This mismatch can mislead users and agents into transmitting data outside the expected local boundary, increasing the risk of unintended data exposure.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill is described as a pandoc/productivity bundle, yet it instructs users to configure API keys and use external services without a clear functional need tied to document conversion. That unjustified credential and network guidance broadens the attack surface and may normalize unnecessary secret handling or remote data transfer.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The file explicitly states that no external API is required, but later sections direct the user to configure API keys and call API endpoints. This contradiction is dangerous because it defeats user expectations about trust boundaries and can cause sensitive content to be sent to external services under false assumptions of local-only processing.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The invocation guidance is generic and broadly encourages chaining multiple member skills with read, write, exec, glob, and grep capabilities without clear activation limits or task boundaries. In a bundled skill context, that can lead an agent to overuse powerful tools in situations where narrower, safer behavior was expected.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The documentation advertises file writing and command execution as normal capabilities but does not prominently warn about their side effects, such as overwriting files, running local commands, or processing untrusted inputs. In a document-conversion bundle, these capabilities are contextually more dangerous because users may assume simple file transformation rather than arbitrary local execution.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.