pdf-ocr-extraction

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 7:38 AM UTC
• Version: 1.0.3

Overview

This skill is a straightforward local PDF OCR helper, but users should be careful with its example temporary-file handling and dependency installation.

Install only in a normal, least-privileged environment. Prefer changing the example to OCR in memory or use a private randomized temporary directory, and set the Tesseract language option to match your document instead of relying on the shown chi_sim+eng default.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:48

Finding

Predictable Temporary Files Permit Symlink Attacks and Data Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-59
Vulnerability Type: Predictable and insecure temporary-file handling
Risk Level: Medium

Vulnerable Code:

python

for i, page in enumerate(doc):
    # Render page to a high-resolution image
    bitmap = page.render(scale=2)
    tmp_img = f"/tmp/page_{i}.png"
    bitmap.to_pil().save(tmp_img)
    
    # Run OCR (assuming English and Simplified Chinese packs are installed)
    text = pytesseract.image_to_string(Image.open(tmp_img), lang='chi_sim+eng')
    full_text.append(text)
    
    # Cleanup temporary file
    os.remove(tmp_img)

Technical Analysis

The example uses fixed temporary paths such as /tmp/page_0.png. These names are predictable and shared by every invocation of the skill. A concurrent process can create or manipulate the expected path before the image is saved.

On systems with a shared /tmp directory, an attacker may pre-create the expected path as a symbolic link. The image-saving operation can follow that link and overwrite the linked destination if the invoking process has sufficient permission. Concurrent OCR executions can also overwrite or delete one another's files, leading to integrity failures and possible cross-user document disclosure.

Cleanup is not protected by a finally block. If PDF rendering, image saving, image loading, or OCR raises an exception, the temporary image remains on disk and may contain sensitive document content.

Attack Path

1. The attacker determines that the first rendered page will use /tmp/page_0.png.
2. Before the victim starts extraction, the attacker creates that path as a symbolic link to a file writable by the victim process.
3. The victim runs the documented extraction script on a PDF.
4. bitmap.to_pil().save(tmp_img) opens the predictable path and may follow the symbolic link.
5. The linked file is overwritten with rendered PDF image data under ...[truncated 821 chars]

Remediation

View remediation

Remediation Suggestions

• Avoid writing page images to disk when possible. Pass the in-memory PIL image directly to pytesseract.image_to_string.
• If disk-backed files are required, create a private randomized directory using tempfile.TemporaryDirectory().
• Create temporary files atomically with restrictive permissions through tempfile.NamedTemporaryFile rather than constructing filenames manually.
• Place cleanup in a finally block or use context managers so files are removed when rendering or OCR fails.
• Ensure temporary directories and files are accessible only to the invoking user.
• Do not reuse temporary paths across pages, documents, users, or concurrent executions.

A safer in-memory approach is:

python

for page in doc:
    bitmap = page.render(scale=2)
    image = bitmap.to_pil()
    text = pytesseract.image_to_string(image, lang="chi_sim+eng")
    full_text.append(text)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:16

Finding

Unpinned Automatically Installable Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-21
Vulnerability Type: Mutable dependency resolution without version or integrity constraints
Risk Level: Low

Vulnerable Code:

json

{
  "id": "pip-deps",
  "kind": "uv",
  "package": "pypdfium2 pytesseract Pillow",
  "label": "Install Python dependencies (pypdfium2, pytesseract, Pillow)"
}

Technical Analysis

The installation metadata identifies three third-party Python packages without pinning reviewed versions or specifying artifact hashes. Each installation can therefore resolve to different package and transitive-dependency versions over time.

The package names are consistent with the skill's stated OCR purpose, and there is no evidence in the audited file that any of the named packages are currently malicious. The risk arises because the metadata permits mutable dependency resolution: a future compromised release, compromised package index, or unexpectedly changed dependency could be installed without an integrity check.

The prose instructing users not to run automated pip install commands at runtime reduces runtime exposure but does not eliminate the risk presented by environments that process the installation metadata automatically.

Attack Path

1. An environment processes the skill's pip-deps installation metadata.
2. The package resolver requests the current versions of pypdfium2, pytesseract, and Pillow, together with their transitive dependencies.
3. A package source or future release supplies a compromised artifact, or dependency resolution selects an unreviewed incompatible version.
4. Because no versions or hashes are specified, the resolver accepts the artifact if ordinary package-index validation succeeds.
5. Malicious package installation hooks or imported package code execute with the permissions of the installation or skill process.

Exploitation depends on compromise or malicious modificatio ...[truncated 714 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each direct dependency to a reviewed, known-good version.
• Maintain a lock file that records all resolved transitive dependencies.
• Require cryptographic hashes for downloaded artifacts where the installation mechanism supports them.
• Retrieve packages only from a trusted, explicitly configured package index.
• Regularly review pinned versions for disclosed vulnerabilities and update them through a controlled process.
• Preserve the existing prohibition against ad hoc runtime installation.
• Install dependencies in an isolated, least-privileged virtual environment rather than system-wide.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example states it assumes English and Simplified Chinese packs are installed and hard-codes lang='chi_sim+eng' in the OCR call. This forces a specific language/locale behavior without user opt-in or an offered choice, which matches the policy-violation category for language or locale constraints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.