converting-content
Warn
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The Python scripts
lmstudio-translate.pyandrecognize-image.pyare designed to automatically install theopenaiandlmstudiopackages viapipat runtime if they are missing. These installations are performed without version pinning or integrity checks. - [COMMAND_EXECUTION]: The conversion instructions in
INSTRUCTIONS.mdutilize a series of Bash commands to handle EPUB files. User-supplied paths are processed through shell variables in commands likepandoc,unzip, andgrep. Although variables are generally quoted, the multi-step shell pipeline presents a potential surface for command injection if filenames are maliciously crafted. - [COMMAND_EXECUTION]: The included Python scripts use
subprocess.check_callto executepipcommands for environment setup, which involves spawning shell processes. - [SAFE]: The skill interacts with LM Studio through a local loopback address (
http://localhost:1234), ensuring that data processed for translation and OCR remains within the user's local environment.
Audit Metadata