file-conversion — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited file-conversion (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Convert files across 1,000+ supported routes using ChangeThisFile. Anonymous conversion is temporarily available in compatibility mode; verified developer keys share quota with REST API usage. Conversions run server-side (FFmpeg, LibreOffice, Calibre, 7-Zip, sharp, Ghostscript); files are deleted within 24 hours.
changethisfile:convert_file, changethisfile:list_conversions) — use them directly. convert_file takes source_url OR base64_content + source_format, plus target_format, and returns a temporary download URL.scripts/convert.sh <input-file> <target-format> [output-file]
# e.g. scripts/convert.sh report.docx pdf
# prints the output file path on successThe script path is relative to this skill's directory. It base64-encodes the file, calls the hosted MCP endpoint over plain HTTPS, downloads the result, and writes it next to the input (or to [output-file]).
curl -sS -X POST https://changethisfile.com/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"convert_file","arguments":{"source_url":"<FILE_URL>","target_format":"pdf"}}}'The response text contains a download URL — fetch it with curl -o <output>.
Ask before guessing if a conversion is exotic:
curl -sS -X POST https://changethisfile.com/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_conversions","arguments":{"source_format":"docx"}}}'Omit source_format for a grouped summary of all supported routes.
POST /v1/convert; verified free keys include 25 conversions/month shared across REST and authenticated MCP.changethisfile.com. On claude.ai, the code-execution sandbox restricts egress by default — prefer the MCP connector there, or the user can allow the domain under Settings → Capabilities.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.