Security audit

eCTD XML Compiler

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a local eCTD document converter, but it overstates regulatory validation and has dependency and scoping issues that warrant review before installation.

Install only in an isolated, approved workspace with non-production or redacted documents unless dependencies are pinned and reviewed. Treat generated XML as a draft skeleton, not validated eCTD-compliant output, and do independent regulatory/schema validation before relying on it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Ambiguous and Unpinned Third-Party Dependencies
Content: View full analysis
Remediation: View remediation
``` 2. Pin reviewed versions of `lxml` and `PyPDF2` as well. 3. Generate a lock file containing cryptographic hashes, such as with `pip-tools`, and install with hash verification: ```bash pip install --require-hashes -r requirements.lock ``` 4. Restrict package installation to approved package indexes and disable untrusted supplemental indexes. 5. Run software-composition analysis and vulnerability scanning against the resolved dependency graph. 6. Install and execute dependencies in a least-privilege, isolated environment without access to unrelated secrets or files. 7. Keep `requirements.txt`, `SKILL.md`, and import statements consistent so that reviewers can verify the exact distributions being used. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:396
Finding: Validation Option Reports Success Without Performing DTD Validation
Content: View full analysis
List[str]: """Validate the generated XML structure""" errors = [] # Basic verification index_file = self.output_dir / "index.xml" if not index_file.exists(): errors.append("Missing main index file index.xml") for module_id in ['m1', 'm2', 'm3', 'm4', 'm5']: module_xml = self.output_dir / module_id / f"{module_id}.xml" if not module_xml.exists(): errors.append(f"Missing module file {module_id}.xml") # DTD validation using lxml (if available) if HAS_LXML: errors.extend(self._dtd_validation()) return errors def _dtd_validation(self) -> List[str]: """DTD verification""" errors = [] # Here you can add the actual DTD validation logic # Need to load ICH eCTD DTD file return errors ``` The related command-line option accepts a custom DTD path but does not connect it to any validation logic: ```python parser.add_argument( '-d', '--dtd-path', help='Custom DTD path' ) ``` ### Technical Analysis The `validate()` method verifies only that the expected files exist. When `lxml` is installed, it invokes `_dtd_validation()`, but that method unconditionally returns an empty error list and never parses a DTD, validates XML structure, checks required attributes, or verifies cross-references. The command-line interface nevertheless treats an empty error list as successful validation. The accepted `--dtd-path` value is never passed to `ECTDCompiler` or otherwise used. This creates false security assurance: output can be described as validated even though only file existence was checked. This issue is especially significant because the project documentation advertises DTD struc ...[truncated 1519 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose materially understates the actual behavior: the skill extracts metadata/content, classifies documents heuristically, writes checksum manifests, and claims validation/compliance it may not actually perform. In a regulatory-document context, this can mislead users into trusting incomplete validation, mishandle sensitive content, and produce incorrect or noncompliant artifacts that may be relied upon in high-stakes submission workflows.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises executable behavior that writes files but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may execute file-writing behavior without a clearly bounded policy surface, increasing the chance of unintended writes or misuse of sensitive document contents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill processes regulatory submission documents, which commonly contain confidential commercial information, patient data, or other sensitive material, yet it does not explicitly warn users that content will be parsed and written back to output files. This increases the risk of accidental disclosure, oversharing, or unsafe handling in shared workspaces because users may not realize the persistence and transformation of sensitive data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file's activation guidance goes beyond eCTD XML compilation and includes generic triggers like academic writing tasks and documented fallback handling. Those phrases are broad enough to overlap with many unrelated requests, making it unclear when this skill should activate versus a different one.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code exposes a validation feature and related messaging that implies XML/DTD verification, but the actual DTD validation routine is a stub that always returns no errors. In a regulatory eCTD workflow, this can cause users to trust malformed or non-compliant XML skeletons, potentially leading to submission failures, processing delays, or downstream integrity issues.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code emits user-facing status and error text such as "mistake" at L503, indicating the CLI is forcing a nonstandard/foreign-language wording pattern rather than consistently using the user's locale or offering a language choice. The policy for this audit requires flagging language or locale constraints when they are imposed without user opt-in.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency docx is unpinned, so builds are not reproducible and future installs may pull in unexpected or vulnerable releases. In a document-processing skill that handles uploaded files, dependency drift increases supply-chain risk and can expose the parser stack to newly introduced flaws without any code change.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
docx lxml pypdf2

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 99% confidence
Finding: The dependency lxml is unpinned, which makes the environment susceptible to supply-chain drift and leaves it unclear which security posture will be deployed. This is more concerning in this skill because lxml is an XML parser used in a document-to-XML conversion pipeline, so parser vulnerabilities can directly affect processing of untrusted uploaded content.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
docx lxml pypdf2

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: lxml has multiple known advisories, and because no version is pinned, it is impossible to verify whether deployment will use a vulnerable release. In this skill's context, that uncertainty matters more because lxml is central to generating and parsing XML for uploaded document content, making parser-related flaws more exposed to attacker-controlled input.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency pypdf2 is unpinned, allowing installation of different versions over time, including versions with known denial-of-service issues. Because this skill processes uploaded PDF documents from users, parser vulnerabilities are more relevant and could be triggered by malformed files to exhaust resources or disrupt service.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
docx lxml pypdf2

Unverifiable Dependency: pypdf2 has 8 known advisory(ies) (CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara); CVE-2023-36807 (PyPDF2 vulnerable to possible Infinite Loop when reading malformed objects); CVE-2023-36810 (PyPDF2 quadratic runtime with malformed PDF missing xref marker) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: pypdf2 has several known advisories, including malformed-PDF denial-of-service conditions, and the unpinned requirement makes it unverifiable whether a safe version is installed. Given that this skill ingests uploaded PDF files, an attacker could plausibly submit crafted documents that trigger parser inefficiency or infinite-loop behavior if a vulnerable version is resolved.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.