Security audit

Pdf

Security checks for vulnerabilities and agentic risk

Overview

This PDF-processing skill is coherent and local-only, with some caution needed around password and in-place repair examples.

Install only if you want a local PDF helper guide that may read your PDFs and create output PDFs, images, JSON, or text files. Use password/decryption commands only for documents you own or are authorized to unlock, and make backups before running any command that repairs or overwrites a PDF.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a clear description-behavior mismatch. The declared description advertises a broad PDF-processing skill, but the supplied code only validates bounding boxes in a fields.json structure. It loads JSON, inspects form_fields entries, checks rectangle intersections by page_number, and ensures entry box height is sufficient for text font size. There is no PDF parsing, creation, editing, OCR, form filling, or other PDF operations in this chunk. The primary purpose is layout validation for form field metadata, not general PDF handling.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is a mismatch because the declared description presents a general-purpose PDF skill covering many operations, but the supplied code only rasterizes PDF pages into PNG files. That behavior is materially narrower and somewhat different from the listed capabilities. While the description mentions 'extracting images,' this code does not extract embedded images from a PDF; it renders whole pages as images. Converting PDFs to images is also not explicitly represented in the description. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This code does not implement broad PDF-file operations as described. Its specific function is to create a validation image by overlaying rectangles on an input image using coordinates from a JSON file for a given page. That is a materially narrower and different purpose than a general PDF manipulation/extraction/OCR skill. While this could be part of a larger PDF form-processing pipeline, the supplied code chunk itself operates on image files and JSON metadata, not directly on PDFs, and none of the declared PDF capabilities are actually present here.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description claims a general-purpose PDF skill covering a wide range of operations such as text/table extraction, merge/split, rotation, watermarking, creation, form filling, encryption, image extraction, and OCR. The supplied code does none of those broad tasks. It specifically inspects PDF AcroForm fields and annotations to enumerate form field metadata and locations, then exports that information as JSON. While this is PDF-related, it is a materially narrower and different primary purpose than the declared all-purpose PDF manipulation/extraction skill. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a general-purpose PDF skill covering many common PDF operations. The supplied code instead performs one specialized task: analyzing a PDF's page geometry to identify text labels, lines, checkbox candidates, and row boundaries for later form-field placement. This is related to PDFs, but its primary behavior is materially narrower and different from the stated broad toolkit. It does not implement most declared functions such as merge/split/rotate/watermark/create/fill/encrypt/OCR, and it adds a specific capability—layout/coordinate extraction for non-fillable forms—that is not clearly represented in the description. Therefore this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The activation text is extremely broad: it triggers whenever a user mentions PDFs or asks to produce one. Overbroad activation can cause the agent to invoke this skill in unrelated or sensitive contexts, increasing the chance of unnecessary file access, unintended handling of documents, or bypass of more specialized safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide provides direct instructions for removing PDF passwords with qpdf but gives no warning to verify authorization, ownership, or lawful use. In a skill context, that omission can normalize assistance with decrypting protected documents and increase the risk of facilitating unauthorized access to sensitive files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The referenced example uses an in-place modification command (qpdf --replace-input corrupted.pdf) that overwrites the original file without any backup or warning. In a skill context, users may copy commands directly, so this can cause accidental data loss or destructive modification of important PDFs if the repair fails or behaves unexpectedly.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes reading/extracting text or tables, merging/splitting, rotating, watermarking, creating/filling forms, encryption/decryption, image extraction, and OCR, but it does not mention rendering PDF pages into standalone raster image files. This script converts every page to PNGs and writes them to disk, which is a different document-conversion capability than the listed PDF-focused operations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.