Ib Summarizer

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:13 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward local document summarizer with disclosed file input and optional output, but it needs dependency pinning and clearer language behavior before use in sensitive environments.

Use this only on documents you are comfortable processing locally, preferably in a virtual environment or container. Before production or regulated use, pin and audit dependencies, remove the unnecessary docx and dataclasses entries, add file-size/time limits for untrusted PDFs or DOCX files, and verify summaries manually because the tool itself says the output is only a reference and not medical advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Ambiguous and Unpinned Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-5
Vulnerability Type: Dependency confusion and unconstrained dependency resolution
Risk Level: Medium

Vulnerable Code:

text

dataclasses
docx
pdfplumber
pypdf2
python-docx

Technical Analysis

The dependency manifest includes both docx and python-docx, although the Document import used by scripts/main.py is supplied by python-docx. The separate docx distribution is unnecessary and creates package-name ambiguity. The dataclasses backport is also unnecessary for the documented Python 3.8 or later runtime.

In addition, none of the dependencies are pinned to reviewed versions or protected by cryptographic hashes. Consequently, the documented pip install -r requirements.txt operation resolves mutable package releases from the configured package index. This exposes installation to dependency confusion, compromised package releases, unexpected upstream changes, and incompatible updates. Python packages may execute build or installation logic during installation, before the application itself is run.

Attack Path

1. A user follows the installation instructions and runs pip install -r requirements.txt.
2. Pip resolves the unnecessary docx distribution and the latest available versions of all unconstrained dependencies.
3. An attacker compromises an upstream release, publishes a malicious package version through an applicable dependency-confusion scenario, or otherwise influences the package index used by the victim.
4. Pip downloads the attacker-controlled distribution because the manifest does not constrain its version or verify its hash.
5. Malicious build or installation logic executes with the operating-system privileges of the user running pip.

This path requires control or compromise of a resolved package source or release; the reviewed project itself does not contain evidence that the currently available depe ...[truncated 515 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unnecessary docx dependency and retain only python-docx, which provides the imported docx module.
2. Remove dataclasses when Python 3.8 or later is enforced.
3. Pin every direct and transitive dependency to a reviewed version using a generated lock file.
4. Record and verify package hashes, for example by installing with pip --require-hashes.
5. Configure pip to use only an approved package index and disable unintended fallback indexes.
6. Regularly scan locked dependencies for known vulnerabilities and review updates before regenerating the lock file.
7. Perform dependency installation in an isolated virtual environment or build container under a non-privileged account.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents file read and file write behavior but does not declare any explicit tool scope such as permissions or allowed-tools. This creates a governance gap: an agent or reviewer cannot reliably constrain what files may be read or written, increasing the risk of unintended file access, path traversal abuse, or overwriting sensitive workspace content if the implementation is permissive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The formatter accepts a language parameter at L375 and the CLI exposes -l/--language with zh and en choices at L486-L487, but to_markdown always renders fixed Chinese headings and notices. This creates a language-policy issue because the user is offered a locale choice that the implementation does not actually honor.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a skill whose purpose is to summarize core safety information from Investigator's Brochures. While reading source documents is expected, this code also persists results to a user-specified file path, which is an additional write capability not implied by a plain summarization description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README presents the skill description and usage headings entirely in Chinese, which imposes a language expectation on users without any opt-in or alternative locale. Under the policy, locale or language constraints should either be optional for users or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The parameter table states that --language defaults to zh, which imposes a specific language choice unless the user overrides it. The policy allows locale constraints only when users are given a choice or the restriction is clearly justified; here the default is forced without any opt-in rationale.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency list is unpinned, so builds may resolve to different versions over time, including vulnerable or breaking releases. This creates a supply-chain risk and reduces reproducibility, even though this file alone does not prove active exploitation.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses
docx
pdfplumber
pypdf2

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency 'docx' is unpinned, allowing installation of whatever version is current at install time. This can introduce vulnerable or incompatible packages and is a common software supply-chain weakness.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

dataclasses
docx
pdfplumber
pypdf2
python-docx

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

An unpinned 'pdfplumber' dependency means the installed version may vary by environment or over time. If a vulnerable release is selected, the skill may be exposed to parsing-related flaws when handling PDFs.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

dataclasses
docx
pdfplumber
pypdf2
python-docx

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The unpinned PyPDF2 dependency is more concerning because PDF parsers routinely process attacker-controlled documents and PyPDF2 has multiple advisories. Without version pinning, deployments could pull in an affected release, enabling denial-of-service or other parser-triggered issues.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

dataclasses
docx
pdfplumber
pypdf2
python-docx

Unverifiable Dependency: pypdf2 has 8 known advisory(ies) (CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara); CVE-2023-36807 (PyPDF2 vulnerable to possible Infinite Loop when reading malformed objects); CVE-2023-36810 (PyPDF2 quadratic runtime with malformed PDF missing xref marker) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

PyPDF2 has known advisories, including infinite-loop and quadratic-runtime issues on malformed PDFs, and the manifest does not pin a version to prove a safe release is used. Because this skill summarizes Investigator's Brochures and likely ingests user-supplied PDF documents, the context increases the likelihood of exposure to parser-driven denial-of-service conditions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The unpinned python-docx dependency presents supply-chain and reproducibility risk, and the package has historical XXE-related advisories. In a skill that parses document content, an unsafe resolved version could expose the system to document-based attacks.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

docx
pdfplumber
pypdf2
python-docx

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

python-docx has known historical XXE-related advisories, and the lack of version pinning prevents verification that the deployed version is fixed. Since this skill likely processes DOCX files from external sources, a vulnerable parser could be abused to trigger XML-based attacks or service disruption.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI advertises a language option with choices 'zh' and 'en', suggesting output language changes, but the markdown formatter ignores the parameter and renders fixed Chinese section titles and labels. This is an intent-code divergence because the exposed interface/documented behavior implies bilingual formatting that the implementation does not provide.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.