LiteParse

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:51 PM UTC
• Version: 1.0.0

Overview

This is a straightforward local document-parsing skill, with some install and offline-disclosure caveats users should understand before use.

Before installing, treat LiteParse as a third-party CLI that can read the documents you point it at. Pin or review the package version if supply-chain control matters, avoid the optional cloud fallback for sensitive documents, and use --no-ocr or preinstalled OCR language data when you need strict no-network operation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:60

Finding

Unpinned Global Package Installation from Mutable Third-Party Sources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60-61
Vulnerability Type: Unpinned third-party dependencies and globally installed tooling
Risk Level: Medium

Vulnerable Code

markdown

- Installed via npm: `npm install -g @llamaindex/liteparse`
- Brew formula exists (`brew tap run-llama/liteparse`) but requires current macOS CLT — use npm as primary install path on this machine

Technical Analysis

The documented npm command installs the latest available version of @llamaindex/liteparse globally without pinning a reviewed version or verifying package integrity. The Homebrew alternative also adds a mutable external tap without pinning or verifying its revision.

Package installation can execute package lifecycle scripts and place executable files in global command paths. Consequently, compromise of the package publisher, npm account, registry distribution channel, or Homebrew tap could cause attacker-controlled code to execute during installation or whenever the lit executable is subsequently invoked.

The reviewed project does not itself contain malicious executable code, and there is no evidence that the named package or tap is currently compromised. The vulnerability is the unsafe, mutable dependency installation process.

Attack Path

1. An attacker compromises the npm publisher account, package release process, registry entry, or external Homebrew tap.
2. The attacker publishes a malicious release or modifies the package formula referenced by the documented installation command.
3. An agent or user follows the Skill instructions and installs the dependency without a pinned version or integrity verification.
4. Malicious lifecycle code may execute during installation, or a malicious lit binary is added to the global executable path.
5. The compromised binary is later invoked to process user documents.
6. The malicious code operates with the privileges of the installing or inv ...[truncated 757 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin LiteParse to a specifically reviewed version, for example:

   bash

   npm install --global @llamaindex/liteparse@<reviewed-version>
   

2. Record and verify the package integrity hash or signed provenance before installation.
3. Prefer a project-local, lockfile-backed installation over a global installation:

   bash

   npm install --save-exact @llamaindex/liteparse@<reviewed-version>
   

4. Run the parser through the local package executable and preserve a reviewed lockfile with integrity metadata.
5. Disable npm lifecycle scripts during installation where compatible, then explicitly review any required installation steps.
6. Execute document parsing in a sandbox or container with restricted filesystem access, no unnecessary credentials, and network access disabled after verified dependencies are installed.
7. If the Homebrew alternative is retained, pin and verify the tap revision and formula rather than trusting the tap's mutable latest state.
8. Establish a controlled update process that reviews release changes before advancing the pinned dependency version.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest states the skill runs entirely offline with no cloud, but the body documents that OCR may download language data on first run and even recommends a cloud fallback for difficult documents. This mismatch can mislead users and agents operating under strict no-network or data-handling assumptions, causing unintended external network access or policy violations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is broad enough to match many generic requests to read or extract content from files, which increases the chance of unintended invocation. In an agent environment, that can route sensitive documents through a tool unexpectedly, expanding access to local files or causing processing that the user did not explicitly intend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation does not prominently warn in the main skill description that OCR may download language data on first run, despite presenting the skill as offline. This omission can cause users or orchestrators to invoke the skill in restricted environments without realizing it may attempt network access during OCR setup.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.