Word Formula Converter

• Outcome: Review
• Latest audit: May 28, 2026 · 10:31 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate Word formula converter, but its optional local web mode handles documents and API keys in ways users should review carefully before installing.

Use the local rule-based CLI for sensitive manuscripts when possible. If using AI review, only use a trusted endpoint and assume formula candidates plus nearby text will be sent there. Avoid saving API keys in the project .env unless plaintext local storage is acceptable, and stop the web server when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises and instructs use of capabilities including shell execution, filesystem access, environment-variable access, and optional network use, but it does not declare permissions. That weakens user/operator consent and sandbox policy enforcement, making it easier for a skill to access sensitive documents, API keys, or perform unintended external communication without clear visibility.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill description materially understates behavior by presenting itself mainly as a local document-conversion tool while the analyzed behavior includes a persistent web app/backend, local storage of uploaded documents and metadata, credential writing to .env files, preview rendering, and broader AI-assisted content generation. This mismatch can mislead users into granting trust or providing sensitive documents under false assumptions about storage, exposure surface, and external processing.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The optional AI review path transmits document-derived formula text, surrounding context, confidence metadata, and identifiers to an arbitrary remote endpoint constructed from base_url. Even though this appears to be a product feature rather than malicious behavior, it creates a real data-exfiltration/privacy risk because manuscript content may be sensitive and the code contains no built-in consent gate, redaction, allowlist, or destination validation beyond normal TLS handling.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The CLI offers an optional AI mode that can send document-derived formula candidate text to a remote API endpoint, which creates a real confidentiality risk for manuscript or document contents. In the context of a tool marketed primarily for local document conversion, this is security-relevant because users may reasonably assume processing is fully local unless explicitly warned otherwise.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The API enables CORS for all origins while exposing powerful state-changing endpoints such as session reset, file upload, AI configuration changes, scanning, and document conversion. If this service is reachable from a browser on the same host or local network, any malicious website can drive the local service via the victim's browser, causing unauthorized file processing, configuration tampering, and possible data exfiltration through later AI-review calls.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The AI review path sends extracted formula text and surrounding document context to a remote endpoint selected by configuration, which can disclose sensitive document contents. Because the skill description emphasizes local conversion, this remote transmission is security-relevant and can unexpectedly leak proprietary or regulated document data if enabled.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The runtime HTTP endpoint permits overwriting the project .env configuration, including API keys and model/base URL settings, without authentication. An attacker who can reach the API can redirect future AI traffic to an attacker-controlled endpoint, replace credentials, or poison persistent configuration for subsequent runs.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The skill enables implicit invocation while describing its use case broadly as converting Word manuscript formulas, without clear trigger boundaries or user-consent constraints. This can cause the agent to invoke the skill in situations where a user mentions Word documents or formulas generally, leading to unintended processing of local documents or unnecessary access to potentially sensitive manuscript content.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The AI review feature clearly initiates requests to a user-configured external model endpoint and, by design, those requests are based on document-derived formula content. The UI exposes configuration and a start button but does not present a clear privacy warning or consent notice at the point of transmission, so users may unknowingly send sensitive manuscript content off-device.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The AI classification request includes candidate text and context extracted from Word documents and sends them to a remote chat completions API, but the code itself provides no user-facing warning, privacy notice, or confirmation step. In the context of academic manuscripts, this can expose unpublished research, personal data, references, or confidential content to third-party services, making the omission security-relevant rather than a mere UX issue.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: AI progress logging prints snippets of candidate source text to stdout, which can expose sensitive formulas or manuscript content in terminals, shell history captures, CI logs, or centralized log collectors. This compounds the external AI mode risk because sensitive content may leak locally even when users only intended remote processing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Persisting API keys to a plaintext project .env file increases the chance of credential exposure through local file access, backups, source-control mistakes, or other processes on the machine. In this app, the risk is amplified because the same configuration can be modified over HTTP, making credential poisoning and disclosure more likely.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The AI review request includes candidate text and surrounding context from uploaded documents, which may contain sensitive or proprietary information. The absence of an in-code disclosure or consent mechanism makes accidental data leakage more likely, especially given the product's local-processing positioning.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: resources/latex_convert_project/apps/web/src/main.tsx:273