Security audit

PDF PPTX Watermark

Security checks for vulnerabilities and agentic risk

Overview

This is a local PDF/PPT watermarking skill with some documentation and UI accuracy issues, but I did not find hidden network access, persistence, credential handling, exfiltration, or purpose-incompatible behavior.

Install only if you are comfortable running a local Python/LibreOffice document-processing tool. Use a virtual environment, avoid running it as administrator/root, keep input and output paths different, and confirm the produced output PDF before relying on the watermark. Treat the phone/live tuning claims as static config-preview support unless the publisher documents an actual QR/mobile workflow.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:96
Finding: Unpinned Third-Party Python Dependencies
Content: View full analysis
Remediation: View remediation
reportlab== ``` 2. Generate and record cryptographic hashes for every direct and transitive dependency, then install with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Generate the locked dependency set through a reproducible dependency-management process, such as `pip-compile`, and review dependency updates before merging them. 4. Document the expected trusted Python package index and avoid untrusted `--extra-index-url` configurations. 5. Install dependencies inside an isolated virtual environment under a non-privileged account. Explicitly warn users not to run pip or the watermark script with administrator or root privileges. 6. Add automated dependency vulnerability and provenance checks to the release process. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/pptx_to_pdf_watermark.py:80
Finding: Input PDF Can Be Truncated When Used as the Output Path
Content: View full analysis
3 else None) # Convert if needed ext = os.path.splitext(input_file)[1].lower() if ext in ('.pptx', '.ppt'): tmp_dir = tempfile.mkdtemp() pdf_path = pptx_to_pdf(input_file, tmp_dir) else: pdf_path = input_file add_watermark(pdf_path, output_file, config) print(f"Watermarked PDF saved: {output_file}") ``` ### Technical Analysis The script does not reject an output path that identifies the same filesystem object as the input PDF. This can occur through identical path strings, relative and absolute representations of the same path, normalized path aliases, hard links, or symbolic links. Opening `output_pdf` with mode `wb` immediately truncates the destination. If it is the input file, the source document is truncated while `PdfReader` or `PdfWriter` may still require access to its underlying data. Processing may fail, produce a corrupt PDF, or replace the original docu ...[truncated 1472 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The core declared functionality largely matches the code: it converts PPT/PPTX to PDF, supports direct PDF watermarking, and allows customization of text, size, opacity, rotation, color, and watermark layouts including diagonal, grid, and center. However, the description prominently claims 'real-time mobile parameter tuning' and live adjustment from a phone, which the code does not implement. There is no network service, web/mobile interface, socket/API endpoint, QR pairing, or real-time control channel—only command-line arguments and JSON config loading, plus a preview generation mode. So this is a partial but material description/behavior mismatch due to the missing mobile live-tuning capability.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README makes a security-relevant assurance ('Local & safe — no network') while also describing phone-based live tuning via QR code, which strongly suggests some form of local web server, device-to-device communication, or network-accessible interface. Misleading security claims can cause users to relax firewall, data-handling, or document-sensitivity precautions and may expose confidential files or configuration endpoints on a local network.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes local executables and processes user-supplied files, but it does not declare any explicit tool scope such as allowed tools or permissions. That makes the runtime trust boundary unclear and can permit broader-than-expected shell or file access if the platform grants defaults or if reviewers assume the skill is passive documentation only.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/pptx_to_pdf_watermark.py (reported line 64)May include surrounding context.
python
def pptx_to_pdf(pptx_path, output_dir): """Convert PPTX to PDF via LibreOffice.""" result = subprocess.run( ['soffice', '--headless', '--convert-to', 'pdf', '--outdir', output_dir, pptx_path], capture_output=True, text=True, timeout=120 )

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a tool that converts PPT/PPTX to PDF and adds watermarks, but the code in this file only renders a local canvas preview and serializes watermark parameters as JSON. There is no code here for opening PPT/PPTX files, generating PDFs, or applying watermarks to PDFs, so the implemented behavior is materially narrower than the stated functionality.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The UI promises to 'export config and add watermark', but the implementation only renders a local preview and copies JSON to the clipboard. In an agent-skill context, this kind of capability mismatch can mislead users into believing a document was actually watermarked or converted, which may result in sensitive files being shared unprotected.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The action wording implies that clicking the button applies a watermark, while the code only copies configuration JSON. This deceptive UX is security-relevant because users may rely on a non-existent protection step before distributing documents, creating a false sense of security around confidential content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documented default parameter uses Chinese text ("内部资料请勿外传") as the watermark content, but the README does not indicate that this is optional for locale reasons or provide explicit language/locale choice guidance. Under the policy rule, forcing or implying a specific language without opt-in can be a natural-language policy concern, even in documentation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code creates a temporary directory, generates intermediate files, and writes a final output PDF, but it does not provide any advance user disclosure about those file-system side effects. Under the code-file warning criterion, file writes can merit a finding when there is no confirmation prompt or explanatory user-facing notice beyond the operation itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document sets the page language to zh-CN, and the visible UI text throughout the page is exclusively Chinese. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation when no language choice or justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document sets lang="zh-CN" and the interface text is presented only in Chinese, which imposes a specific language/locale on users. The file does not offer language selection or explain that the tool is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code writes the generated watermark configuration to the user's clipboard, which is a user-affecting operation that can overwrite existing clipboard contents. Although a status message is shown after the copy, there is no warning or confirmation before the clipboard is modified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.