Back to skill

Security audit

Pdf Rename

Security checks across malware telemetry and agentic risk

Overview

The skill mainly does PDF renaming, but it ships leftover document text/path state and optional LLM/file-renaming scripts that need review before installation.

Install only if you are comfortable with a PDF organizer that reads the first pages of every PDF in a chosen folder, stores extracted text in manifest files, and can rename files when run with --execute. Run extract and preview before execute, avoid running the undocumented helper scripts, and do not use llm_parse.py on private or unpublished PDFs unless you trust the local LLM gateway and its downstream data handling.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares no permissions, but its documented workflow reads PDFs, writes manifests and rename outputs, and references an optional LLM parser that implies network access. Undeclared capabilities are dangerous because they prevent users and enforcement systems from understanding what the skill can do, increasing the risk of unauthorized file modification or data exfiltration from PDF contents.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The described purpose is narrow paper renaming, but the referenced behavior includes external chat-completions calls, broad processing across unrelated folders, and ad hoc maintenance scripts that directly alter manifests and filenames. This mismatch is risky because users may authorize a simple organizer while the implementation performs wider file operations and potentially sends document content to external services, creating integrity and confidentiality risks.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The code sends up to 4000 characters of extracted PDF text to an HTTP chat-completions API, which introduces data exfiltration behavior beyond simple local file renaming. Even though the endpoint is localhost, it is still a separate service boundary and may forward data to external models or plugins, exposing potentially sensitive paper contents without an explicit trust or consent check.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The script performs network-style HTTP API access to a chat completion endpoint to accomplish metadata extraction, adding a capability that is not obviously necessary for a PDF renaming skill. This expands the attack surface and trust boundary, because a local gateway may proxy requests elsewhere or be impersonated by another local service bound to the same port.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This file is not a minimal skill manifest; it is effectively a bulk data store containing a large corpus of user document metadata and extracted contents. For a PDF-renaming skill, embedding unrelated document bodies and workflow state in a manifest expands the trust boundary, increases accidental data exposure risk, and can cause downstream components to process attacker-controlled text as if it were configuration.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The file stores absolute local file paths and large raw document excerpts, which is unnecessary for the stated renaming purpose and leaks sensitive user environment details. If logs, prompts, errors, or analytics capture this manifest, it can expose private document contents and workstation path information far beyond what is needed to rename files.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script extracts raw text from the first pages of every PDF, stores that content in manifest.json, and prints previews to stdout. Academic PDFs can contain unpublished research, reviewer comments, personal information, or licensed material, so persisting and echoing that text can expose sensitive content through logs, terminals, shared workspaces, or later processing stages without explicit user awareness.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Raw document text is transmitted to an LLM API without any visible user-facing warning, consent flow, or data classification check. Academic PDFs may contain unpublished work, private notes, or licensed content, so silent transmission can create confidentiality and compliance risks even if the feature works as intended.

Ssd 1

Medium
Confidence
93% confidence
Finding
Untrusted PDF text is inserted directly into the LLM prompt, so adversarial content inside a document can instruct the model to ignore extraction rules, emit malformed JSON, or fabricate metadata. In an LLM-driven pipeline this can corrupt downstream rename decisions and, depending on the surrounding system, may also induce leakage of additional prompt context or unexpected tool behavior.

Context Window Stuffing

Medium
Category
Memory Poisoning
Content
"filepath": "C:/Users/taizun/Desktop/tmp\\Ch-var-adv.pdf",
    "year_hint": null,
    "status": "needs_llm_review",
    "raw_text": "Contents\n10 Advanced variance reduction 3\n10.1 Grid-based stratification . . . . . . . . . . . . . . . . . . . . . . . 3\n10.2 Stratification and antithetics . . . . . . . . . . . . . . . . . . . . 6\n10.3 Latin hypercube sampling . . . . . . . . . . . . . . . . . . . . . . 8\n10.4 Orthogonal array sampling . . . . . . . . . . . . . . . . . . . . . 12\n10.5 Adaptive importance sampling . . . . . . . . . . . . . . . . . . . 17\n10.6 Nonparametric AIS . . . . . . . . . . . . . . . . . . . . . . . . . 28\n10.7 Generalized antithetic sampling . . . . . . . . . . . . . . . . . . . 36\n10.8 Control variates with antithetics and stratification . . . . . . . . 37\n10.9 Bridge, umbrella and path sampling . . . . . . . . . . . . . . . . 39\nEnd notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51\nExercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55\n1\n2 Contents\n© Art Owen 2009–2013 do not distribute or post electronically without\nauthor’s permission\n10\nAdvanced variance reduction\nThis chapter collects together some advanced and specialized topics in vari-\nance reduction. They are generalizations, extensions and hybrids of methods\npreviously considered.\nWe begin with § 10.1 on grid-based stratification, suitable for low dimensions\nIn dimension d it improves the Monte Carlo RMSE to O(n−1/2−1/d). In § 10.2\nwe apply antithetic sampling within those strata, yielding a method of Haber\nwith RMSE O(n−1/2−2/d). Then § 10.3 presents Latin hypercube sampling, a\nstratification method suitable for large or even unbounded dimension. We round\nout our mini-chapter on advanced stratification with § 10.4 on orthogonal array\nsampling, which is very well suited to intermediate dimensionalities.\nImportance sampling can provide great efficiency gains, but it is difficult to\ndo well and a poor choice can s
...[truncated 25 chars]
Confidence
89% confidence
Finding
. . . . . . . . . . . . . . . . . . . . . . .

Context Window Stuffing

Medium
Category
Memory Poisoning
Content
"filepath": "C:/Users/taizun/Desktop/tmp\\Ch-var-adv.pdf",
    "year_hint": null,
    "status": "needs_llm_review",
    "raw_text": "Contents\n10 Advanced variance reduction 3\n10.1 Grid-based stratification . . . . . . . . . . . . . . . . . . . . . . . 3\n10.2 Stratification and antithetics . . . . . . . . . . . . . . . . . . . . 6\n10.3 Latin hypercube sampling . . . . . . . . . . . . . . . . . . . . . . 8\n10.4 Orthogonal array sampling . . . . . . . . . . . . . . . . . . . . . 12\n10.5 Adaptive importance sampling . . . . . . . . . . . . . . . . . . . 17\n10.6 Nonparametric AIS . . . . . . . . . . . . . . . . . . . . . . . . . 28\n10.7 Generalized antithetic sampling . . . . . . . . . . . . . . . . . . . 36\n10.8 Control variates with antithetics and stratification . . . . . . . . 37\n10.9 Bridge, umbrella and path sampling . . . . . . . . . . . . . . . . 39\nEnd notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51\nExercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55\n1\n2 Contents\n© Art Owen 2009–2013 do not distribute or post electronically without\nauthor’s permission\n10\nAdvanced variance reduction\nThis chapter collects together some advanced and specialized topics in vari-\nance reduction. They are generalizations, extensions and hybrids of methods\npreviously considered.\nWe begin with § 10.1 on grid-based stratification, suitable for low dimensions\nIn dimension d it improves the Monte Carlo RMSE to O(n−1/2−1/d). In § 10.2\nwe apply antithetic sampling within those strata, yielding a method of Haber\nwith RMSE O(n−1/2−2/d). Then § 10.3 presents Latin hypercube sampling, a\nstratification method suitable for large or even unbounded dimension. We round\nout our mini-chapter on advanced stratification with § 10.4 on orthogonal array\nsampling, which is very well suited to intermediate dimensionalities.\nImportance sampling can provide great efficiency gains, but it is difficult to\ndo well and a poor choice can s
...[truncated 25 chars]
Confidence
89% confidence
Finding
. . . . . . . . . . . . . . . . . . . . . .

Context Window Stuffing

Medium
Category
Memory Poisoning
Content
"filepath": "C:/Users/taizun/Desktop/tmp\\Ch-var-adv.pdf",
    "year_hint": null,
    "status": "needs_llm_review",
    "raw_text": "Contents\n10 Advanced variance reduction 3\n10.1 Grid-based stratification . . . . . . . . . . . . . . . . . . . . . . . 3\n10.2 Stratification and antithetics . . . . . . . . . . . . . . . . . . . . 6\n10.3 Latin hypercube sampling . . . . . . . . . . . . . . . . . . . . . . 8\n10.4 Orthogonal array sampling . . . . . . . . . . . . . . . . . . . . . 12\n10.5 Adaptive importance sampling . . . . . . . . . . . . . . . . . . . 17\n10.6 Nonparametric AIS . . . . . . . . . . . . . . . . . . . . . . . . . 28\n10.7 Generalized antithetic sampling . . . . . . . . . . . . . . . . . . . 36\n10.8 Control variates with antithetics and stratification . . . . . . . . 37\n10.9 Bridge, umbrella and path sampling . . . . . . . . . . . . . . . . 39\nEnd notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51\nExercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55\n1\n2 Contents\n© Art Owen 2009–2013 do not distribute or post electronically without\nauthor’s permission\n10\nAdvanced variance reduction\nThis chapter collects together some advanced and specialized topics in vari-\nance reduction. They are generalizations, extensions and hybrids of methods\npreviously considered.\nWe begin with § 10.1 on grid-based stratification, suitable for low dimensions\nIn dimension d it improves the Monte Carlo RMSE to O(n−1/2−1/d). In § 10.2\nwe apply antithetic sampling within those strata, yielding a method of Haber\nwith RMSE O(n−1/2−2/d). Then § 10.3 presents Latin hypercube sampling, a\nstratification method suitable for large or even unbounded dimension. We round\nout our mini-chapter on advanced stratification with § 10.4 on orthogonal array\nsampling, which is very well suited to intermediate dimensionalities.\nImportance sampling can provide great efficiency gains, but it is difficult to\ndo well and a poor choice can s
...[truncated 25 chars]
Confidence
89% confidence
Finding
. . . . . . . . . . . . . . . . . . . . .

Context Window Stuffing

Medium
Category
Memory Poisoning
Content
"filepath": "C:/Users/taizun/Desktop/tmp\\Ch-var-adv.pdf",
    "year_hint": null,
    "status": "needs_llm_review",
    "raw_text": "Contents\n10 Advanced variance reduction 3\n10.1 Grid-based stratification . . . . . . . . . . . . . . . . . . . . . . . 3\n10.2 Stratification and antithetics . . . . . . . . . . . . . . . . . . . . 6\n10.3 Latin hypercube sampling . . . . . . . . . . . . . . . . . . . . . . 8\n10.4 Orthogonal array sampling . . . . . . . . . . . . . . . . . . . . . 12\n10.5 Adaptive importance sampling . . . . . . . . . . . . . . . . . . . 17\n10.6 Nonparametric AIS . . . . . . . . . . . . . . . . . . . . . . . . . 28\n10.7 Generalized antithetic sampling . . . . . . . . . . . . . . . . . . . 36\n10.8 Control variates with antithetics and stratification . . . . . . . . 37\n10.9 Bridge, umbrella and path sampling . . . . . . . . . . . . . . . . 39\nEnd notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51\nExercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55\n1\n2 Contents\n© Art Owen 2009–2013 do not distribute or post electronically without\nauthor’s permission\n10\nAdvanced variance reduction\nThis chapter collects together some advanced and specialized topics in vari-\nance reduction. They are generalizations, extensions and hybrids of methods\npreviously considered.\nWe begin with § 10.1 on grid-based stratification, suitable for low dimensions\nIn dimension d it improves the Monte Carlo RMSE to O(n−1/2−1/d). In § 10.2\nwe apply antithetic sampling within those strata, yielding a method of Haber\nwith RMSE O(n−1/2−2/d). Then § 10.3 presents Latin hypercube sampling, a\nstratification method suitable for large or even unbounded dimension. We round\nout our mini-chapter on advanced stratification with § 10.4 on orthogonal array\nsampling, which is very well suited to intermediate dimensionalities.\nImportance sampling can provide great efficiency gains, but it is difficult to\ndo well and a poor choice can s
...[truncated 25 chars]
Confidence
89% confidence
Finding
. . . . . . . . . . . . . . . . . . . . . . . . .

Context Window Stuffing

Medium
Category
Memory Poisoning
Content
"filepath": "C:/Users/taizun/Desktop/tmp\\Ch-var-adv.pdf",
    "year_hint": null,
    "status": "needs_llm_review",
    "raw_text": "Contents\n10 Advanced variance reduction 3\n10.1 Grid-based stratification . . . . . . . . . . . . . . . . . . . . . . . 3\n10.2 Stratification and antithetics . . . . . . . . . . . . . . . . . . . . 6\n10.3 Latin hypercube sampling . . . . . . . . . . . . . . . . . . . . . . 8\n10.4 Orthogonal array sampling . . . . . . . . . . . . . . . . . . . . . 12\n10.5 Adaptive importance sampling . . . . . . . . . . . . . . . . . . . 17\n10.6 Nonparametric AIS . . . . . . . . . . . . . . . . . . . . . . . . . 28\n10.7 Generalized antithetic sampling . . . . . . . . . . . . . . . . . . . 36\n10.8 Control variates with antithetics and stratification . . . . . . . . 37\n10.9 Bridge, umbrella and path sampling . . . . . . . . . . . . . . . . 39\nEnd notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51\nExercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55\n1\n2 Contents\n© Art Owen 2009–2013 do not distribute or post electronically without\nauthor’s permission\n10\nAdvanced variance reduction\nThis chapter collects together some advanced and specialized topics in vari-\nance reduction. They are generalizations, extensions and hybrids of methods\npreviously considered.\nWe begin with § 10.1 on grid-based stratification, suitable for low dimensions\nIn dimension d it improves the Monte Carlo RMSE to O(n−1/2−1/d). In § 10.2\nwe apply antithetic sampling within those strata, yielding a method of Haber\nwith RMSE O(n−1/2−2/d). Then § 10.3 presents Latin hypercube sampling, a\nstratification method suitable for large or even unbounded dimension. We round\nout our mini-chapter on advanced stratification with § 10.4 on orthogonal array\nsampling, which is very well suited to intermediate dimensionalities.\nImportance sampling can provide great efficiency gains, but it is difficult to\ndo well and a poor choice can s
...[truncated 25 chars]
Confidence
89% confidence
Finding
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Context Window Stuffing

Medium
Category
Memory Poisoning
Content
"filepath": "C:/Users/taizun/Desktop/tmp\\Ch-var-adv.pdf",
    "year_hint": null,
    "status": "needs_llm_review",
    "raw_text": "Contents\n10 Advanced variance reduction 3\n10.1 Grid-based stratification . . . . . . . . . . . . . . . . . . . . . . . 3\n10.2 Stratification and antithetics . . . . . . . . . . . . . . . . . . . . 6\n10.3 Latin hypercube sampling . . . . . . . . . . . . . . . . . . . . . . 8\n10.4 Orthogonal array sampling . . . . . . . . . . . . . . . . . . . . . 12\n10.5 Adaptive importance sampling . . . . . . . . . . . . . . . . . . . 17\n10.6 Nonparametric AIS . . . . . . . . . . . . . . . . . . . . . . . . . 28\n10.7 Generalized antithetic sampling . . . . . . . . . . . . . . . . . . . 36\n10.8 Control variates with antithetics and stratification . . . . . . . . 37\n10.9 Bridge, umbrella and path sampling . . . . . . . . . . . . . . . . 39\nEnd notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51\nExercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55\n1\n2 Contents\n© Art Owen 2009–2013 do not distribute or post electronically without\nauthor’s permission\n10\nAdvanced variance reduction\nThis chapter collects together some advanced and specialized topics in vari-\nance reduction. They are generalizations, extensions and hybrids of methods\npreviously considered.\nWe begin with § 10.1 on grid-based stratification, suitable for low dimensions\nIn dimension d it improves the Monte Carlo RMSE to O(n−1/2−1/d). In § 10.2\nwe apply antithetic sampling within those strata, yielding a method of Haber\nwith RMSE O(n−1/2−2/d). Then § 10.3 presents Latin hypercube sampling, a\nstratification method suitable for large or even unbounded dimension. We round\nout our mini-chapter on advanced stratification with § 10.4 on orthogonal array\nsampling, which is very well suited to intermediate dimensionalities.\nImportance sampling can provide great efficiency gains, but it is difficult to\ndo well and a poor choice can s
...[truncated 25 chars]
Confidence
89% confidence
Finding
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.