智能文档助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:14 AM UTC
• Version: 2.0.4

Overview

DocPilot appears to be a legitimate remote document-processing client, but it uploads sensitive documents to a configurable external service with under-disclosed privacy controls and weak bundled configuration handling.

Install only if you are comfortable sending selected documents to the DocPilot/TokenAI service or a configured endpoint. Do not use it for regulated or confidential documents until the publisher documents retention, deletion, jurisdiction, and privacy terms, removes bundled config.json secrets, makes environment variables take precedence, validates allowed HTTPS destinations, and pins dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: config.json:1

Finding

Plaintext API Credential and Unsafe Configuration Precedence

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.py:43

Finding

Sensitive Documents Are Uploaded Without Adequate Privacy Controls

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Dependency Version Is Not Reproducibly Pinned

Content

View full analysis

=2.28.0 ``` ### Technical Analysis The dependency declaration specifies only a minimum version and permits installation of any later `requests` release. As a result, two installations performed at different times can resolve to different dependency versions without any change to the reviewed Skill package. No evidence was found that `requests` itself is malicious or that the project uses a typosquatted package or untrusted package index. The risk is supply-chain drift: future, unreviewed versions or transitive dependencies can be introduced automatically during installation. The absence of hashes also prevents the installer from verifying that downloaded artifacts exactly match a reviewed set. ### Attack Path 1. An operator installs the Skill using `pip install -r requirements.txt`. 2. The package resolver selects the newest available version satisfying `requests>=2.28.0`. 3. That version may differ from the version tested or reviewed by the Skill author. 4. If a future release or resolved transitive component is compromised, malicious, or incompatible, it is imported into the Skill's Python process. 5. The dependency then executes with the same local privileges as the Skill and can access documents, configuration values, API credentials, and network requests handled by that process. ### Impact Assessment A compromised dependency would run with the Skill process's privileges. Its potential scope includes reading files accessible to the invoking user, accessing the API credential, intercepting uploaded document contents, modifying API requests or responses, and making network connections. This is a preventive supply-chain finding rather than evidence of a currently compromised dependency. The observed package name is legitimate and ...[truncated 70 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (24)

Tainted flow: 'api_url' from os.environ.get (line 133, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The skill builds the destination URL from environment/config input and then uploads the local document file to that URL. If an attacker can influence DOCPilot_BASE_URL or config.json, they can redirect sensitive documents and the bearer token to an arbitrary server, turning the skill into an exfiltration channel.

Content

Scanner excerpt · index.py (reported line 75)May include surrounding context.

python

if md_return_image:
                data["md_image_format"] = md_image_format

            response = requests.post(api_url, headers=headers, files=files, data=data, timeout=120)

            if response.status_code == 200:
                result = response.json()

Tainted flow: 'api_url' from os.environ.get (line 133, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

This extraction path sends the user-supplied document to a remote URL derived from environment/config without validating that the endpoint is trusted. A modified base_url can capture uploaded document contents, extraction schemas/prompts, and authorization headers.

Content

Scanner excerpt · index.py (reported line 115)May include surrounding context.

python

if options:
                data["options"] = json.dumps(options) if isinstance(options, dict) else options

            response = requests.post(api_url, headers=headers, files=files, data=data, timeout=120)

            if response.status_code == 200:
                result = response.json()

Tainted flow: 'api_url' from os.environ.get (line 133, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The classification flow also uploads local files to a remotely configurable endpoint, so compromise or manipulation of configuration can silently reroute documents to an attacker-controlled service. Because the skill's core function is document handling, this creates substantial confidentiality risk for potentially sensitive files.

Content

Scanner excerpt · index.py (reported line 146)May include surrounding context.

python

if category_schema:
                data["category_schema"] = json.dumps(category_schema) if isinstance(category_schema, dict) else category_schema

            response = requests.post(api_url, headers=headers, files=files, data=data, timeout=120)

            if response.status_code == 200:
                result = response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README documents local file processing workflows but does not clearly warn users that documents and their contents are sent to a remote DocPilot service endpoint for analysis. Because this skill handles potentially sensitive contracts, invoices, audits, and handwritten forms, the omission can cause users to unknowingly transmit confidential or regulated data off-host, creating privacy, compliance, and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README shows configuration of a remote base URL and API key, but the usage section does not clearly disclose that user-supplied documents are uploaded to and processed by a third-party DocPilot service. For a document-processing skill, this can expose sensitive contracts, invoices, IDs, or internal files without informed user consent, creating privacy, compliance, and data-handling risks.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises document-processing capabilities but does not declare any explicit tool scope or permissions despite requiring environment variables, file access, and network access. This weakens sandboxing and informed consent because hosts and users cannot clearly see that local files may be read and sent to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill lacks a prominent warning that documents, OCR text, extracted fields, and metadata may be sent to a remote service. In the context of document handling, this is especially dangerous because the typical inputs are often highly sensitive business, financial, legal, or personal records, so silent exfiltration can create confidentiality, compliance, and data residency risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The configuration shows that the skill depends on a remote HTTPS API, which means user-supplied documents and extracted data are transmitted off-host. Because this remote processing capability is not clearly stated in the manifest description, users may unintentionally expose sensitive contracts, invoices, or personal data to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest advertises document parsing and extraction features and defines a remote API base URL plus API key authentication, but it does not clearly disclose that user-supplied documents may be uploaded to an external service. Because these documents may contain sensitive business, legal, financial, or personal data, the omission can cause users or downstream agents to transmit confidential files without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The field key and description are written only in Chinese ("利润表", "利润表相关内容"), which imposes a language choice in the skill artifact without any opt-in or explanation. The policy allows locale-specific behavior only when it is explicitly justified or when users are given a language/locale choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill presents itself as a document-processing tool, but its core operations work by uploading documents to an external service rather than clearly local processing. This mismatch can mislead users into exposing confidential documents under false assumptions about where processing occurs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The parse operation transmits the entire local document to an external API, but the interface only indicates a generic parsing action and does not clearly warn the user about off-device data transfer. For document workflows, that omission is significant because files may contain PII, contracts, financial data, or regulated content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Field extraction sends document contents and possibly user prompts/schema data to a remote service without a clear privacy notice. Users may reasonably believe extraction is a local capability and unknowingly disclose sensitive structured information to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Classification similarly uploads local files externally without prominently disclosing that the content leaves the user's environment. Because classification is often used on large batches of internal documents, undisclosed transfer raises real confidentiality and compliance concerns.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 64% confidence

Finding

All user-facing documentation, commands, parameters, and examples are presented in English, and there is no indication that users may choose another language or locale. Under the stated policy, a skill should not impose a specific language without opt-in unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

SQP-3 适用于所有文件类型。该 README 从标题、说明、参数解释到示例均以中文呈现，未说明这是面向特定中文用户群/地区的限定版本，也未提供用户语言选择；这可能构成未获用户选择的语言/locale 限制。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The natural-language description, commands context, parameter explanations, and examples are entirely presented in Chinese, with no indication that other languages or locales are supported or that Chinese is a deliberate region-specific limitation. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The file hardcodes English and Chinese descriptions throughout the manifest, with no indication that the user can select or override language/locale behavior. Under the policy, fixed language behavior without user opt-in can be a natural-language policy concern unless the locale constraint is documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This SVG contains fixed Chinese text content ("词元汇智") as part of the asset, which imposes a specific language presentation with no indication of user opt-in or locale scoping. Under the natural-language policy rule, fixed locale-specific wording can be a policy concern when no choice or justification is present.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The module description and all user-facing CLI messages are written in Chinese, with no indication that another language is supported or that the locale is intentionally limited. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The stated purpose covers parsing, information extraction, and classification, but does not mention credential handling or service configuration. Reading API keys from environment variables and local config is understandable for a cloud client, yet that capability is not justified by the manifest as written and materially expands what the skill accesses.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency specification uses a lower-bound only constraint (requests>=2.28.0) rather than pinning to a specific version or constrained safe range. This makes builds non-reproducible and can allow installation of unexpectedly vulnerable or breaking versions depending on when and where the package is installed.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest references requests without pinning a specific version, while the package has multiple historical advisories. Because the resolved version is not fixed, it is impossible to verify from this file alone whether deployment will use a version affected by known issues such as credential leakage or other security flaws.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This JSON schema hard-codes all user-facing field names and descriptions in Chinese. For a general-purpose skill artifact, that can violate language/locale policy because it forces a specific language without offering opt-in or documenting that the skill is intended only for a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.