converting-content

Warn

Audited by Gen Agent Trust Hub on Mar 29, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The Python scripts lmstudio-translate.py and recognize-image.py are designed to automatically install the openai and lmstudio packages via pip at runtime if they are missing. These installations are performed without version pinning or integrity checks.
  • [COMMAND_EXECUTION]: The conversion instructions in INSTRUCTIONS.md utilize a series of Bash commands to handle EPUB files. User-supplied paths are processed through shell variables in commands like pandoc, unzip, and grep. Although variables are generally quoted, the multi-step shell pipeline presents a potential surface for command injection if filenames are maliciously crafted.
  • [COMMAND_EXECUTION]: The included Python scripts use subprocess.check_call to execute pip commands for environment setup, which involves spawning shell processes.
  • [SAFE]: The skill interacts with LM Studio through a local loopback address (http://localhost:1234), ensuring that data processed for translation and OCR remains within the user's local environment.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 29, 2026, 11:13 PM