Convert Code Snippets

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 1.0.0

Overview

This is a code-conversion instruction skill with some sloppy template documentation, but no evidence of hidden execution, exfiltration, persistence, or destructive behavior.

Install only if you want an agent instruction set for converting code and structured data. Treat the README read/write mode and API_KEY entries as stale template documentation unless the publisher clarifies them; do not provide credentials for this skill based on the current artifacts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description claims this skill is for transforming code from one language or representation to another. However, the code does not perform any code conversion or transformation. Its primary behavior is to run QA checks against a skill package: reading SKILL.md, parsing YAML frontmatter, verifying naming/description/license/metadata, checking for documentation sections like Modes/Do not/Quality Bar, scanning for secrets, and confirming presence of repository files such as README_zh.md and CONTRIBUTING.md. This is a materially different purpose from code conversion, so the description does not accurately represent the code.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- Do not convert code that uses a library/framework not available in the target ecosystem without warning

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

| Criterion | Minimum | Ideal |
|-----------|---------|-------|
| Syntax validity | Output parses without error in target language | Output passes linter with no warnings |
| Semantic equivalence | Approximate functional equivalence >= 70% | >= 90% with manual review only for complex features |
| Standard library mapping | All detected stdlib calls mapped to target equivalent | Verified by running converted code against test cases |
| Type preservation | Type annotations preserved where possible | Full type inference in target language |

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file states 'Keep SKILL.md body in English,' which is a natural-language policy constraint forcing a specific language. The document does not offer contributors a language choice or explain a justified regional/compliance reason for the restriction.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The line 'SKILL.md body must be in English; reference docs in English' mandates a specific language across documentation. This is a natural-language policy violation unless the restriction is optional or explicitly justified by a documented operational need.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The README leaves the trigger condition as a placeholder ('When triggered: [trigger condition]'), so operators and routing logic do not have a clear boundary for when this skill should run. In an agent environment, ambiguous activation criteria can cause the skill to be invoked on unintended inputs, increasing the chance of unsafe code transformation, mishandling of data, or inappropriate autonomous use.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README documents a '--mode write' path but gives no warning about data-modifying behavior, output destinations, overwrite semantics, or need for user confirmation. In an agentic setting, this can lead users or orchestration systems to run the skill in a state-changing mode without understanding that files may be created or altered, increasing risk of unintended data loss or unauthorized modification.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: The trigger condition is left as a placeholder, so the activation boundary for the skill is undefined. In agent ecosystems, vague triggering can cause the wrong skill to run on inappropriate inputs, which may expose data to unnecessary processing or produce unsafe actions due to role confusion.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The README presents 'read' and 'write' operating modes that do not align with the skill's declared purpose of converting code snippets. This mismatch can mislead users or downstream agents into invoking file-reading or file-modifying behavior that is broader than expected, increasing the risk of unintended data access or modification.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README describes a write mode but provides no warning that it may modify files or data. For a skill advertised as code conversion, undocumented write behavior materially increases the chance of destructive or unauthorized changes because users may assume the operation is purely transformational and in-memory.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The README claims an API key is required even though the skill metadata describes a local conversion utility. This inconsistency can cause users or automation to expose sensitive credentials unnecessarily, creating credential-handling risk without a legitimate need.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Static analysis

No suspicious patterns detected.