Security audit

Beautiful PDF

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent PDF-generation workflow with local rendering helpers and no evidence of hidden data access, persistence, or exfiltration.

Install from a trusted source and prefer pinned versions where available. Use the helper on documents you are allowed to process, keep private PDFs and generated page images private, and avoid unusually high DPI settings or untrusted large PDFs unless running in a constrained environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:19
Finding: Unpinned third-party package execution during installation## Vulnerability Details **File Location**: `README.md:19-23` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown ## Install ```bash npx skills add AntreasAntoniou/beautiful-pdf ``` ``` ### Technical Analysis The documented installation command invokes `npx` without pinning the `skills` package to an exact, reviewed version. Depending on the local environment and cache state, `npx` can retrieve and execute the latest available version of that package. The referenced Skill source is also identified by a mutable repository name rather than an immutable commit, verified release, or integrity hash. Consequently, the code executed during a future installation may differ from the content covered by this audit. No evidence indicates that the currently audited project or dependency is malicious. The vulnerability is the lack of dependency and source immutability, which unnecessarily expands the installation-time supply-chain trust boundary. ### Attack Path 1. An attacker compromises the package registry account, the `skills` package, its maintainer account, or the referenced upstream repository. 2. The attacker publishes a malicious package version or modifies the mutable Skill source. 3. A user follows the documented `npx skills add AntreasAntoniou/beautiful-pdf` command. 4. `npx` retrieves the unpinned package, and the installer resolves the mutable Skill source. 5. Malicious installation logic executes with the permissions of the user running the command. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the installing user's account. The resulting scope could include reading or modifying user-accessible files, accessing environment variables and credentials available to that process, altering installed Skill content, and making outbound network requests. This finding does not provide privilege escalat ...[truncated 130 chars]
Remediation: ## Remediation Suggestions 1. Pin the installer package to an exact reviewed version, for example by using an explicit `skills@x.y.z` version supported by the package ecosystem. 2. Pin the Skill source to an immutable commit digest or cryptographically verified release rather than a mutable repository reference. 3. Use lockfiles and registry integrity metadata where applicable. 4. Publish expected checksums or signatures for release artifacts and document how users should verify them. 5. Recommend reviewing installation scripts before execution and running installation with the least-privileged account required. 6. Establish an update process in which dependency changes are reviewed and tested before the documented pinned versions are changed.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/pdf-to-png.py:43
Finding: Unrestricted rasterization DPI can cause local resource exhaustion## Vulnerability Details **File Location**: `scripts/pdf-to-png.py:43-50`; input accepted at `scripts/pdf-to-png.py:67-70` **Vulnerability Type**: Missing numeric input bounds leading to resource exhaustion **Risk Level**: Low ### Vulnerable Code ```python output_files: list[str] = [] zoom = dpi / 72.0 matrix = fitz.Matrix(zoom, zoom) for i, page in enumerate(doc): pix = page.get_pixmap(matrix=matrix) out_path = out / f"page-{i + 1}.png" pix.save(str(out_path)) ``` The unrestricted value is accepted by the command-line interface: ```python args = parser.parse_args() pdf_to_png(args.pdf, args.output_dir, args.dpi) ``` The associated argument declaration is: ```python parser.add_argument("--dpi", type=int, default=200, help="Render DPI (default: 200)") ``` ### Technical Analysis The caller-controlled `dpi` value is converted directly into a PyMuPDF rasterization scale without minimum, maximum, page-count, output-size, or estimated pixel-allocation checks. Raster memory grows approximately with the square of the scale factor. An unusually large DPI can therefore cause `page.get_pixmap()` to request extremely large pixel buffers. A large or many-page PDF compounds the issue because every page is rendered and saved. The script also creates the output directory before verifying that the input PDF exists, although that behavior alone has limited security significance. This is a local availability weakness rather than remote code execution. Exploitation requires the ability to influence the command arguments or persuade an operator or agent to process a document using an excessive DPI. ### Attack Path 1. An attacker supplies a PDF, instructions, or automation input that requests an extreme DPI value, such as hundreds of thousands of DPI. 2. The script accepts the value because `argparse` checks only that it is an integer. 3. The value is used to construct an oversized `fitz.Matrix`. ...[truncated 749 chars]
Remediation: ## Remediation Suggestions 1. Validate DPI before opening or rendering the document. Reject nonpositive values and impose a conservative upper bound, such as 600 DPI: ```python MIN_DPI = 36 MAX_DPI = 600 if not MIN_DPI <= dpi <= MAX_DPI: raise ValueError(f"DPI must be between {MIN_DPI} and {MAX_DPI}") ``` 2. Use a custom `argparse` type or parser error so invalid values fail before output-directory creation. 3. Calculate the expected pixel dimensions of each page before rasterization and reject pages exceeding a configured pixel or memory budget. 4. Add configurable limits for page count and cumulative estimated output size. 5. Catch PyMuPDF and memory-related exceptions, close the document through a context manager or `finally` block, and remove incomplete output where appropriate. 6. Run conversion of untrusted PDFs in a resource-constrained process or sandbox with memory, CPU, execution-time, and disk quotas. 7. Add tests covering zero, negative, and excessively large DPI values.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.