Anyparse Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:51 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it can upload private documents and an API key over a user-configured endpoint that is shown as cleartext HTTP and is not constrained or clearly warned about.

Install only if you understand that files you ask it to parse are uploaded to the AnyParse endpoint you configure. Use an HTTPS endpoint you control or trust, keep the API key narrowly scoped and revocable, avoid sending confidential files unless the service is approved for them, and consider pinning dependencies before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/api.py:98

Finding

Cleartext HTTP Transport Exposes Uploaded Documents and API Credentials

Content

View full analysis

Vulnerability Details

File Location: scripts/api.py:98-116; insecure configuration examples also appear in scripts/config.json:2, SKILL.md:73-81, and SKILL_zh.md:73-82
Vulnerability Type: Sensitive information transmitted over cleartext transport
Risk Level: High

Vulnerable Code

scripts/api.py:98-116:

python

        headers = {
            "Authorization": f"Bearer {anyparse_api_key}"
        }

        url = f"{anyparse_api_url}"

        args = {
            "use_doc_cls": use_doc_cls,
            "use_doc_rectifier": use_doc_rectifier,
            "use_doc_layout": use_doc_layout,
        }

        files = {
            'file': open(f"{filepath}",'rb')
        }

        res = rq.post(url, files = files, data = args, headers = headers)
        return res.json()

scripts/config.json:1-4:

json

{
    "anyparse_api_url": "http://your-api-host:port/anyparse/invoke/v1",
    "anyparse_api_key": "your-api-key"
}

SKILL.md:73-81:

json

{
  "anyparse_api_url": "http://your-api-host:port/anyparse/invoke/v1",
  "anyparse_api_key": "your-api-key-here"
}

bash

export anyparse_api_url=http://your-api-host:port/anyparse/invoke/v1

Technical Analysis

The script uploads the complete user-selected document and sends the API credential in an Authorization: Bearer header to the configured URL. It does not validate the URL scheme or reject remote cleartext HTTP endpoints. The bundled configuration and documentation explicitly demonstrate an http:// endpoint, making insecure deployment likely.

When HTTP is used, neither the bearer credential nor the multipart document upload receives transport confidentiality or endpoint authentication. A network-positioned attacker can observe the request, recover the API key and document, modify uploaded data, or substitute the API response. The problem does not apply when a correctly valida ...[truncated 1164 chars]

Remediation

View remediation

Remediation Suggestions

1. Require https:// for all non-loopback API endpoints and reject unsupported or cleartext schemes before opening the document.
2. Permit HTTP only through an explicit opt-in intended for trusted loopback or isolated private deployments, accompanied by a prominent warning.
3. Replace all http:// examples in config.json, SKILL.md, and SKILL_zh.md with https://.
4. Retain TLS certificate verification and do not introduce verify=False.
5. Consider restricting the endpoint to an administrator-approved hostname allowlist to reduce accidental document disclosure to an unintended server.
6. Use narrowly scoped, revocable API keys and rotate any key that may previously have been transmitted over HTTP.
7. Open the file through a context manager so it is reliably closed after the request.

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unpinned Runtime Dependency Creates a Supply-Chain and Reproducibility Risk

Content

View full analysis

Vulnerability Details

File Location: scripts/requirements.txt:1; installation is directed by SKILL.md:64-68 and SKILL_zh.md:64-68
Vulnerability Type: Unconstrained third-party dependency installation
Risk Level: Medium

Vulnerable Code

scripts/requirements.txt:1:

text

requests

SKILL.md:64-68:

markdown

2. Install dependencies:

   ```bash
   pip install -r scripts/requirements.txt
   ```

Technical Analysis

The dependency specification provides neither an exact reviewed version nor an integrity hash. Consequently, the documented installation command resolves whichever requests release and transitive dependencies are available from the active package index at installation time.

This makes installations non-reproducible and allows dependency behavior to change without a corresponding review of this project. If an upstream release or one of its resolved dependencies is compromised, or if the operator uses an untrusted package index, malicious package code can execute during installation or when api.py imports requests. No evidence shows that the current requests package is malicious; the confirmed issue is the absence of version and integrity controls.

Attack Path

1. An attacker compromises a future upstream package release, a transitive dependency, or a package index used by the operator.
2. The operator follows the documentation and runs pip install -r scripts/requirements.txt.
3. Because no version or hash is constrained, the installer resolves the attacker-controlled or otherwise unreviewed artifact.
4. Package installation hooks or imported package code execute in the context of the installing user.
5. Malicious dependency code can access resources available to that user, including documents processed by the skill and environment-based API configuration.

Impact Assessment

Exploitation could execute arbitrary code with the privileges of ...[truncated 364 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests to a reviewed exact version rather than leaving it unconstrained.
2. Resolve and pin all transitive dependencies using a controlled lock-generation process.
3. Generate hash-locked requirements and install with pip install --require-hashes -r scripts/requirements.txt.
4. Retrieve packages only from an explicitly trusted index over TLS.
5. Add automated dependency vulnerability and provenance checks to the release process.
6. Update pinned dependencies through a controlled review and testing workflow rather than accepting releases automatically.
7. Perform installation in an isolated virtual environment with the least privileges required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tainted flow: 'url' from os.environ.get (line 91, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The request destination is sourced from config/environment and used directly in requests.post, while the code also uploads the referenced local file and includes a bearer token. If an attacker can influence anyparse_api_url or the skill is misconfigured, this can exfiltrate arbitrary local documents and credentials to an attacker-controlled endpoint. In a document-parsing skill, this is especially sensitive because users are likely to provide private files for processing.

Content

Scanner excerpt · scripts/api.py (reported line 103)May include surrounding context.

python

'file': open(f"{filepath}",'rb')
        }

        res = rq.post(url, files = files, data = args, headers = headers)
        return res.json()    
    except Exception as e:
        return {

Tainted flow: 'files' from open (line 99, file read) → requests.post (network output)

High

• Category: Data Flow
• Confidence: 97% confidence

Finding

The code opens a local file path and sends its contents directly to a remote service with no trust validation of the endpoint and no consent gate at the point of transmission. This creates a direct file exfiltration path: any file the caller can point to will be uploaded off-host, which is dangerous in an agent skill that may process sensitive enterprise or personal documents.

Content

Scanner excerpt · scripts/api.py (reported line 103)May include surrounding context.

python

'file': open(f"{filepath}",'rb')
        }

        res = rq.post(url, files = files, data = args, headers = headers)
        return res.json()    
    except Exception as e:
        return {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill requires environment variables, reads local files, and sends data over the network, but it does not declare an explicit permission/tool scope. That weakens reviewability and enforcement, making it easier for a host agent or user to invoke a skill with broader capabilities than expected. In this context the risk is real because the skill’s primary purpose is to read user-supplied documents and transmit them to an API endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill states it sends requests to the configured AnyParse API, but it does not clearly and prominently warn that full document contents and related metadata leave the local system and are transmitted to another service. Users may reasonably assume parsing is local, especially because the skill advertises 'local deployment' and privacy control, which can downplay the actual exfiltration boundary. This is particularly sensitive because supported inputs include PDFs, emails, notebooks, and images that may contain confidential data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill’s trigger guidance includes broad, everyday phrases such as “文字提取”, “内容抽取”, and “文档转换”, which can match many ordinary user intents and cause the skill to be invoked when the user did not explicitly request this external document-parsing service. In this skill’s context, unintended invocation matters because it can lead to local files being sent to the configured AnyParse API endpoint, creating avoidable data exposure or privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script's core behavior is to transmit local document contents to a remote API, but the code provides no user-facing warning, consent prompt, or prominent disclosure at the upload point. In the context of a parsing skill, users may assume local-only processing, so the lack of transparency materially increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

L048-L054 的强制限制要求技能在失败时固定按文档规定方式响应，并整体文档内容仅以中文呈现，没有说明用户可选择其他语言或该语言限制的适用范围。按照语言/locale 政策，若技能隐含强制单一语言而无用户选择或明确正当理由，属于自然语言策略问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script loads an API key from config or environment variables and uses it for remote authentication, which is access to sensitive credentials. There is no comment, warning, or user-facing disclosure explaining this credential usage in the code path, so users may not realize the skill depends on and consumes secret material.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency manifest specifies requests without a version pin, which makes builds non-reproducible and can result in installing an unintended or vulnerable release. In a document-parsing skill that likely handles remote files and API calls, this increases supply-chain and operational risk because the exact security posture of the installed package is unknown.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Because requests is unpinned, it is impossible to verify whether the installed version includes fixes for known advisories affecting some releases. This is especially relevant for a skill that interfaces with external APIs and may fetch remote content, where HTTP client flaws could contribute to credential leakage, TLS verification issues, or other request-handling weaknesses depending on the resolved version.

Content

No source excerpt is available for this finding.