Known Vulnerable Dependency: pymupdf — 2 advisory(ies): CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py); CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)
Medium
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
- pymupdf
Security audit
PDF Extraction (auto text/OCR)
Security checks across malware telemetry and agentic risk
Overview
This skill is a straightforward local PDF extraction tool, with dependency hygiene notes but no hidden or purpose-mismatched behavior found.
Install this only in an environment where PDF parsing risk is acceptable. For sensitive or hostile PDFs, use an isolated environment and ensure dependency resolution selects patched versions of PyMuPDF and Pillow rather than old vulnerable releases.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)
Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more
Critical
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
- Pillow
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.