T09 · Insecure Skill Coding Practices
Warning
- Location
pdf_extract/cli.py:94- Finding
Unbounded OCR DPI Enables Resource-Exhaustion Denial of Service
- Content
View full analysis
- Remediation
View remediation
Security audit
pdf-extraction
Security checks for vulnerabilities and agentic risk
Overview
This is a local PDF text/OCR extraction skill with reasonable purpose fit and no evidence of hidden data exfiltration or malicious behavior.
Install in a virtual environment, prefer a pinned tag or commit instead of mutable main, and only use sudo for Tesseract if you trust the package source. Run it only on PDFs you are authorized to process, choose output paths carefully to avoid overwriting files, and keep OCR DPI/page ranges reasonable for large or untrusted PDFs.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:34- Finding
Mutable and Unconstrained Installation Sources Reduce Supply-Chain Integrity
- Content
View full analysis
=68", "wheel"] build-backend = "setuptools.build_meta" ``` ```toml dependencies = [ "pdfplumber>=0.11", "pymupdf>=1.24", "Pillow>=10", ] ``` ### Technical Analysis Installing from a Git repository without an immutable commit identifier causes the effective package contents to depend on the state of the repository at installation time. Code installed in the future may differ from the artifact covered by this audit. The version tag example is safer than the mutable branch but is still not cryptographically verified by the instructions. The runtime and build dependencies also have no upper bounds, lock file, or hashes, allowing future releases to be selected automatically. Python package installation can execute build-backend code during the build process, while installed package code executes with the privileges of the invoking user. Consequently, compromise of the upstream repository, a dependency account, release infrastructure, or package distribution channel could introduce code that was not present during this review. This finding does not establish that any current dependency is malicious. It identifies a supply-chain integrity weakness that permits unaudited future code to enter installations. ### Attack Path 1. An attacker compromises the upstream Git repository, a maintainer ac ...[truncated 1419 chars]- Remediation
View remediation
" ``` 2. Prefer signed and verified release artifacts from a trusted package registry. 3. Publish cryptographic hashes and use hash-verified installation where practical: ```bash pip install --require-hashes -r requirements.txt ``` 4. Maintain a deployment lock file or constraints file containing reviewed versions of all direct and transitive dependencies. 5. Add compatible upper bounds where appropriate and test dependency upgrades before releasing them. 6. Pin or constrain build-system dependencies because build dependencies execute during package construction. 7. Protect source and package-publishing accounts with multifactor authentication, branch protection, restricted release permissions, and signed tags or commits. 8. Run installation without administrative privileges and inside an isolated virtual environment or container. 9. Add automated dependency vulnerability scanning and provenance verification to the release process. ]]>
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Python 3.10+: `pdfplumber`, `pymupdf`, `Pillow` (see `pyproject.toml`)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu / Debian sudo apt install tesseract-ocr tesseract-ocr-eng # 繁中可選： # sudo apt install tesseract-ocr-chi-tra
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu / Debian sudo apt install tesseract-ocr tesseract-ocr-eng # 繁中可選： # sudo apt install tesseract-ocr-chi-tra
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md # Ubuntu / Debian sudo apt install tesseract-ocr tesseract-ocr-eng # 繁中可選： # sudo apt install tesseract-ocr-chi-tra # macOS # brew install tesseract
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md # Ubuntu / Debian sudo apt install tesseract-ocr tesseract-ocr-eng # 繁中可選： # sudo apt install tesseract-ocr-chi-tra # macOS # brew install tesseract
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documentation appears to force a specific language/locale for instructions and usage details, with no alternative language option or explicit user opt-in. Under the stated policy, language constraints should either be optional or clearly justified as region-specific.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file documents a skill that reads PDFs, extracts their text, and can emit the contents to stdout or output files. Because PDFs often contain sensitive personal or business information, the usage section should include a user-facing warning about handling confidential content, especially when OCR is applied to scanned documents.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs users and agents to write extracted content to paths via
-o out.txt,-o out.md, and-o out.jsonwithout warning about overwriting existing files or choosing safe destinations. In agentic contexts, this can lead to accidental clobbering of user data if filenames are reused or derived unsafely from prompts.- Content
Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unverifiable Dependency: wheel has 4 known advisory(ies) (CVE-2026-24049 (Wheel Affected by Arbitrary File Permission Modification via Path Traversal in w); CVE-2022-40898 (pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)); CVE-2022-40898 (An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlie) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unverifiable Dependency: pymupdf has 2 known advisory(ies) (CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py); CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content