Security checks across static analysis, malware telemetry, and agentic risk
The skill appears to perform the promised Word formula conversion, but its web API can expose saved AI credentials and send manuscript snippets to user-configurable external AI endpoints.
Review before installing. Use the local rule-based workflow for confidential manuscripts, or use a trusted/self-hosted AI endpoint. Avoid saving valuable API keys in the Web UI unless the machine and browser session are trusted, stop the local web server after use, and remove the project .env and storage files when finished.
Word Formula Converter turns manually typed math in Word documents into editable Word equations while preserving layout through local Word/LibreOffice conversion and OOXML edits. By default it works entirely on the user's machine. Optional AI review can improve formula detection and LaTeX normalization; when enabled, only extracted formula candidates and minimal surrounding context are sent to the user-configured model endpoint. Full documents, generated outputs, and API keys are not bundled or uploaded by the default workflow.
if not candidates:
raise HTTPException(400, "No candidates to review")
api_key = options.api_key or env_first("OPENAI_API_KEY", "API_KEY")
base_url = options.base_url or env_first("OPENAI_BASE_URL", "BASE_URL", default="https://api.openai.com/v1")
model = options.model or env_first("OPENAI_MODEL", "MODEL", default="gpt-4.1-mini")
if not api_key:
raise HTTPException(400, "Missing API key")if not candidates:
raise HTTPException(400, "No candidates to review")
api_key = options.api_key or env_first("OPENAI_API_KEY", "API_KEY")
base_url = options.base_url or env_first("OPENAI_BASE_URL", "BASE_URL", default="https://api.openai.com/v1")
model = options.model or env_first("OPENAI_MODEL", "MODEL", default="gpt-4.1-mini")
if not api_key:
raise HTTPException(400, "Missing API key")def read_ai_config() -> dict:
_load_dotenv(overwrite=True)
return {
"api_key": os.environ.get("OPENAI_API_KEY") or os.environ.get("API_KEY") or "",
"base_url": os.environ.get("OPENAI_BASE_URL") or os.environ.get("BASE_URL") or "https://api.openai.com/v1",
"model": os.environ.get("OPENAI_MODEL") or os.environ.get("MODEL") or "gpt-4.1-mini",
"batch_size": _env_int("AI_BATCH_SIZE", 10),def read_ai_config() -> dict:
_load_dotenv(overwrite=True)
return {
"api_key": os.environ.get("OPENAI_API_KEY") or os.environ.get("API_KEY") or "",
"base_url": os.environ.get("OPENAI_BASE_URL") or os.environ.get("BASE_URL") or "https://api.openai.com/v1",
"model": os.environ.get("OPENAI_MODEL") or os.environ.get("MODEL") or "gpt-4.1-mini",
"batch_size": _env_int("AI_BATCH_SIZE", 10),def write_ai_config(config: AiConfig) -> None:
env_path = ROOT / ".env"
existing: dict[str, str] = {}
if env_path.exists():
for raw_line in env_path.read_text(encoding="utf-8").splitlines():VirusTotal findings are pending for this skill version.