Resilient PDF

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:37 PM UTC
• Version:
  1.1.0

Overview

This skill is a transparent PDF fallback helper that downloads or reads user-specified PDFs, extracts text locally, and writes chosen output files.

Install if you are comfortable letting the skill fetch PDFs you specify and run local uvx/markitdown against them. Prefer trusted PDF URLs, keep outputs inside a workspace directory, and do not silently install dependencies or process sensitive PDFs unless you trust the local extraction toolchain.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to read and write local files, fetch remote PDFs over the network, and invoke shell commands, yet no permissions are declared. That mismatch weakens policy enforcement and user visibility: a caller may assume the skill is low-privilege when it can actually download untrusted content and execute local tooling against it.

VirusTotal

65/65 vendors flagged this skill as clean.