doc-extract-filter

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:01 PM UTC
• Version: 1.1.1

Overview

This is a coherent document extraction and filtering skill, with expected local file reads and batch output writes that users should handle carefully.

Install in a virtual environment, review or pin dependencies before use, and avoid running batch mode on broad private folders unless you intend to save extracted document text into JSON output files. Treat regex patterns and untrusted PDFs as potentially resource-intensive inputs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:8

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:8-20
Vulnerability Type: Unpinned dependencies and non-reproducible package installation
Risk Level: Medium

Vulnerable Code

text

python-markdown  # Markdown file processing
beautifulsoup4  # Extract text from HTML

# CLI
click==8.1.3

# Other
tqdm==4.67.3

# Optional dependencies for OCR
pytesseract; python_version >= "3.6"  # OCR text recognition
pdf2image; python_version >= "3.6"  # Convert PDF files to images
Pillow; python_version >= "3.6"  # Image processing

The affected packages are:

• python-markdown
• beautifulsoup4
• pytesseract
• pdf2image
• Pillow

Technical Analysis

These dependencies have no exact version constraints or integrity hashes. Consequently, executing the installation procedure documented by the project can resolve to whichever compatible package release is available from the configured Python package index at installation time.

This prevents reproducible builds and means that the installed code can change after the Skill has been reviewed. If a package publisher account, package-index route, or configured mirror is compromised, a malicious or otherwise unsafe release could be selected automatically. Python packages may execute code during installation and subsequently when imported.

The project does not use --require-hashes, a hash-locked requirements file, or another dependency lock mechanism to verify that retrieved artifacts are the versions reviewed by the project maintainers.

Attack Path

1. An attacker compromises the publication channel for one of the unpinned packages, or an untrusted package mirror serves a modified release.
2. A user follows the installation instructions and runs pip install -r requirements.txt.
3. pip resolves the unpinned dependency to the attacker-controlled or otherwise unsafe release.
4. Package-controlled code executes during install ...[truncated 719 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a specifically reviewed version using exact == constraints.
2. Generate and commit a fully resolved lock file that includes transitive dependencies.
3. Record cryptographic hashes for all package artifacts and install with pip --require-hashes.
4. Retrieve dependencies only from an approved HTTPS package index or controlled internal mirror.
5. Run dependency vulnerability and provenance checks in CI before accepting lock-file changes.
6. Separate optional OCR dependencies into an optional requirements file or package extra so they are installed only when OCR is required.
7. Perform installations in an isolated virtual environment under a non-privileged account.

T09 · Insecure Skill Coding Practices

Warning

• Location: core/filter.py:112

Finding

User-Controlled Regular Expressions Can Cause Resource Exhaustion

Content

View full analysis

Vulnerability Details

File Location: core/filter.py:112-129 and core/filter.py:236-243; inputs are exposed by scripts/doc-extract-filter.py:320-324
Vulnerability Type: Regular expression denial of service
Risk Level: Medium

Vulnerable Code

Primary inclusion-pattern evaluation:

python

try:
    regex = re.compile(pattern)
    results = []

    if isinstance(content, str):
        content_list = [content]
    else:
        content_list = content

    for idx, text in enumerate(content_list):
        if not isinstance(text, str):
            continue

        # Split text by line or paragraph
        if filter_level == "line":
            segments = text.split('\n')
        else:  # paragraph
            segments = text.split('\n\n')

        for seg_idx, segment in enumerate(segments):
            matches = regex.finditer(segment)

Exclusion-pattern evaluation:

python

# Check the exclusion regular expression
if exclude_regex:
    if re.search(exclude_regex, text, re.MULTILINE | re.DOTALL):
        return True

The patterns are supplied through CLI options:

python

@click.option('--regex', help='Regular expression pattern')
@click.option('--enable-ocr', is_flag=True, help='Enable OCR support for scanned PDF files')
@click.option('--exclude-keywords', help='Comma-separated exclusion keyword list')
@click.option('--exclude-regex', help='Exclusion regular expression pattern')

Technical Analysis

The Skill compiles and evaluates user-controlled regular expressions with Python's standard backtracking re engine. It imposes no execution timeout, pattern-complexity restriction, extracted-text size limit, segment-size limit, or per-file processing deadline.

Ambiguous nested quantifiers and similar constructions can trigger catastrophic backtracking when evaluated against carefully structured non-matching text. The primary pattern is repe ...[truncated 1783 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace Python's unrestricted backtracking evaluation with a regex implementation that supports enforceable execution timeouts or guarantees linear-time matching.
2. Apply a strict per-pattern and per-file deadline in a separately terminable worker process; a thread-only timeout cannot reliably interrupt CPU-bound matching.
3. Reject or require explicit authorization for risky constructs, including nested ambiguous quantifiers and excessive repetition.
4. Limit pattern length, extracted document size, individual segment length, match count, and the number of files processed in one batch.
5. Validate context_length as a bounded, non-negative value and enforce global resource quotas.
6. Stop processing and return a structured error when a regex exceeds its execution budget.
7. Add regression tests using known catastrophic-backtracking patterns and large adversarial documents.
8. If arbitrary regular expressions are unnecessary, replace the interface with literal matching or a constrained pattern language.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Known Vulnerable Dependency: PyPDF2==3.0.1 — 2 advisory(ies): CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara); CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

PyPDF2==3.0.1 is pinned to a version with a known denial-of-service issue (CVE-2023-36464), where crafted PDF input can trigger an infinite loop during parsing. In a document-processing skill, this is especially relevant because attackers can supply malicious PDFs and cause the agent or host process to hang or exhaust resources.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: click==8.1.3 — 1 advisory(ies): CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documentation explicitly supports batch processing with an output directory and merged JSON output, which implies creating directories and writing result files to disk, but it does not clearly warn users about these side effects. In agent/tooling environments, undocumented filesystem writes can violate user expectations, overwrite existing data, or persist sensitive extracted document contents in locations the user did not anticipate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code performs bulk file reads from a directory and creates new CSV/XLSX files beside each source file, which can affect user data and filesystem state. Although errors are logged, there is no confirmation prompt or user-facing notice before the batch file-writing operation occurs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The OCR call uses lang='chi_sim+eng', which forces a specific language/locale behavior for all users. This matches the policy category for language or locale restrictions because the code does not provide an opt-in, configuration option, or documented justification for limiting OCR to Chinese and English.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code file uses Chinese throughout its natural-language comments, docstrings, status messages, and exported text, with no indication that language is configurable or intentionally limited to a Chinese-only context. Under the policy rule for language/locale constraints, this can amount to forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The export function writes matched content, surrounding context, and positions directly to disk, which can persist sensitive source text, secrets, personal data, or confidential excerpts extracted during filtering. In a content-scanning skill, this context makes the issue more dangerous because the very purpose of the module is to surface potentially sensitive matches, so exporting them without explicit safeguards increases the risk of unintended disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains natural-language content exclusively in Chinese, including module comments, docstrings, log/error messages, and API-facing default text. Under the policy rule, forcing a specific language without user opt-in or clear documented regional justification is a locale-policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code saves each processing result to disk, including the extracted text field populated earlier from document contents. While the file-writing behavior is visible in code, there is no print, prompt, or inline warning near the operation disclosing that potentially sensitive document contents will be stored in output files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The merged batch result is serialized to a JSON file and includes file_results containing extracted text from processed documents. The script does not provide a specific warning that batch mode may create a consolidated file containing sensitive contents from multiple documents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Comments and docstrings throughout the file are presented exclusively in Chinese, including module and function descriptions. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless clearly justified or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This requirements file includes natural-language comments entirely in Chinese, such as the section headers and package descriptions. That imposes a specific language choice in user-facing project metadata without indicating any opt-in, alternative locale, or region-specific justification.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The module docstring and command-line help text are presented exclusively in Chinese, which effectively forces a specific language for users of the skill. Under the language/locale policy, this is a natural-language constraint unless the skill offers a language choice or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.