Pdf Contract Redactor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:58 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent contract-redaction purpose, but its implementation can leave or recreate sensitive contract data despite appearing to redact it.

Review before installing. Do not use this skill for confidential contracts unless you accept Alibaba Cloud upload of document pages and the risk that generated outputs, logs, or sidecar JSON files may still expose the values you intended to hide. Prefer a version that uses secure PDF redaction or page rasterization, avoids plaintext value export by default, removes sensitive stdout logging, and uses safer credential handling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/redact_contract.py:204

Finding

Redacted PDF Retains Recoverable Underlying Content

Content

View full analysis

Vulnerability Details

File Location: scripts/redact_contract.py:204-217
Vulnerability Type: Insecure visual-only redaction
Risk Level: High

Vulnerable Code:

python

for page_num, page_values in values_by_page.items():
    if page_num >= len(doc):
        continue
    page = doc[page_num]
    for fv in page_values:
        x0, y0, x1, y1 = fv.value_bbox
        pdf_x0, pdf_y0 = x0 * scale, y0 * scale
        pdf_x1, pdf_y1 = x1 * scale, y1 * scale
        padding = 3
        rect = fitz.Rect(pdf_x0 - padding, pdf_y0 - padding, pdf_x1 + padding, pdf_y1 + padding)
        page.draw_rect(rect, color=(0, 0, 0), fill=(0, 0, 0))

doc.save(output_path)
doc.close()

Technical Analysis

The implementation draws opaque rectangles over sensitive values but does not remove the underlying PDF text, image pixels, or content streams. An opaque drawing operation is a visual overlay rather than a secure redaction operation.

Existing text may remain available through text extraction, while scanned image pixels remain embedded beneath the rectangle. PDF editing or forensic tools may also permit removal or bypass of the overlay object. Consequently, the generated file can appear redacted while continuing to contain the original confidential information.

Attack Path

1. A user processes a confidential contract and distributes the generated redacted PDF.
2. An attacker obtains that PDF without requiring access to the source document.
3. The attacker uses a PDF editor, object inspector, text extractor, or content-stream parser.
4. The attacker removes or bypasses the rectangle objects, extracts underlying text, or recovers the original scanned image.
5. Sensitive contract values hidden by the visual overlays are disclosed.

Impact Assessment

This issue can disclose identities, telephone numbers, addresses, bank accounts, contract amounts, project identifiers, and other contract data. ...[truncated 160 chars]

Remediation

View remediation

Remediation Suggestions

• Use PyMuPDF redaction annotations and invoke the API that permanently applies those redactions.
• Save the result with appropriate garbage collection and content cleaning so removed objects are not retained.
• For scanned contracts, flatten each finalized redacted page into a new raster image and construct a new image-only PDF.
• Ensure metadata, embedded files, annotations, alternate image representations, and OCR text layers are also sanitized.
• Add automated tests that attempt text extraction, object removal, image extraction, and content-stream inspection on generated files.
• Do not describe an output as securely redacted unless these recovery tests fail.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/redact_contract.py:220

Finding

Sensitive Redacted Values Are Exported to a Plaintext JSON Sidecar

Content

View full analysis

Vulnerability Details

File Location: scripts/redact_contract.py:220-224
Vulnerability Type: Plaintext storage of sensitive information
Risk Level: High

Vulnerable Code:

python

def export_results(self, field_values: List[FieldValue], output_path: str) -> None:
    data = [{"field_name": fv.field_name, "value": fv.value, "page": fv.page + 1,
             "field_bbox": fv.field_bbox, "value_bbox": fv.value_bbox} for fv in field_values]
    with open(output_path, 'w', encoding='utf-8') as f:
        json.dump(data, f, ensure_ascii=False, indent=2)

The export is invoked unconditionally:

python

json_path = output_pdf.replace('.pdf', '_fields.json')
redactor.export_results(field_values, json_path)

Technical Analysis

The JSON sidecar stores every recognized value that the tool is intended to conceal. The data is written in plaintext with default filesystem permissions and without encryption, access-control validation, retention controls, or an explicit user opt-in.

This creates a second copy of the confidential information and undermines the privacy objective of producing a redacted document. Depending on the process umask and destination directory, the file may be accessible to other local users, backup services, synchronization tools, or anyone receiving the output directory.

Attack Path

1. A user runs the redactor on a sensitive contract.
2. The script automatically creates a _fields.json file next to the output PDF.
3. The sidecar contains field names and their complete unredacted values.
4. Another local user, backup operator, synchronization service, malware process, or accidental recipient reads the file.
5. The supposedly redacted contract data is recovered directly without attacking the PDF.

Impact Assessment

The exposure covers all matched values, potentially including names, phone numbers, mailing addresses, invoice and payment details, bank accoun ...[truncated 221 chars]

Remediation

View remediation

Remediation Suggestions

• Do not generate a sidecar containing confidential values by default.
• If diagnostics are required, make export an explicit opt-in option and omit or irreversibly hash recognized values.
• Create diagnostic files with restrictive permissions such as 0600.
• Support an explicitly selected, access-controlled output directory.
• Encrypt any operationally required sensitive export and define a short retention period.
• Document secure deletion, backup, and sharing requirements.
• Prefer aggregate results such as field names, match counts, confidence ranges, and page numbers without storing the values.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/redact_contract.py:246

Finding

Sensitive Contract Values Are Printed to Standard Output

Content

View full analysis

Vulnerability Details

File Location: scripts/redact_contract.py:246-247
Vulnerability Type: Sensitive information exposure through logs
Risk Level: High

Vulnerable Code:

python

for fv in field_values[:10]:
    print(f"  [{fv.field_name}] = {fv.value[:30]}")

Technical Analysis

The script prints up to the first 30 characters of the first ten recognized sensitive values. Standard output is commonly captured by terminals, CI/CD systems, task runners, agent transcripts, centralized logging platforms, and monitoring systems.

Truncation does not provide meaningful protection because many relevant values—including names, telephone numbers, account numbers, dates, and monetary amounts—fit entirely within 30 characters.

Attack Path

1. The redactor runs interactively, through an agent, or in an automated job.
2. Matched confidential values are printed to standard output.
3. A terminal recorder, job runner, agent transcript, or logging service retains the output.
4. A user with access to those logs reads the confidential contract values.
5. The information persists independently of deletion or protection of the generated PDF.

Impact Assessment

The issue can expose up to ten matched values per execution to every system or user authorized to collect or read process output. It does not grant system privileges, but it expands sensitive-data access to logging and operational personnel who may not be authorized to inspect contract contents.

Remediation

View remediation

Remediation Suggestions

• Remove all logging of recognized values.
• Log only non-sensitive status information, such as page counts, match counts, and opaque identifiers.
• If detailed debugging is essential, require an explicit debug option and redact or hash all values.
• Disable sensitive debug output in production and agent-driven environments.
• Review existing terminal, CI, and centralized logs for exposed values and apply appropriate retention or deletion procedures.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/redact_contract.py:228

Finding

Alibaba Cloud Credentials Are Supplied Through Process-Visible Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/redact_contract.py:228-234
Vulnerability Type: Insecure credential handling
Risk Level: Medium

Vulnerable Code:

python

def main():
    if len(sys.argv) < 4:
        print("Usage: python redact_contract.py <input.pdf> <access_key_id> <access_key_secret> [output.pdf]")
        sys.exit(1)

    input_pdf = sys.argv[1]
    access_key_id = sys.argv[2]
    access_key_secret = sys.argv[3]

The documented invocation also instructs users to place credentials on the command line:

bash

python scripts/redact_contract.py contract.pdf LTAIxxx xxx contract_redacted.pdf

Technical Analysis

Command-line arguments may be exposed through process listings, shell history, job definitions, audit telemetry, crash reports, and automation logs. Local users or monitoring services able to inspect process metadata may recover both the access-key ID and secret.

The implementation also stores the secret in the client object, but the observed custom request does not use it to compute a request signature. The access-key ID is included in URL query parameters. This suggests incomplete custom authentication handling and unnecessarily exposes credential material.

Attack Path

1. A user follows the documented command and places long-lived cloud credentials in process arguments.
2. The command is recorded in shell history or an automation system, or is observed while running through process inspection.
3. An attacker or unauthorized operator obtains the access-key ID and secret.
4. The attacker authenticates to Alibaba Cloud using those credentials.
5. The attacker accesses any cloud resources and API operations permitted by the associated identity.

Impact Assessment

The resulting privileges are bounded by the Alibaba Cloud permissions assigned to the compromised identity. If the credentials are not restricted to OCR, the exp ...[truncated 208 chars]

Remediation

View remediation

Remediation Suggestions

• Remove cloud secrets from command-line arguments.
• Use Alibaba Cloud's official SDK and standard credential-provider chain.
• Prefer short-lived credentials supplied through a protected credential file, workload identity, instance role, or environment-based secret injection.
• Apply restrictive file permissions to any credential configuration.
• Assign an OCR-only role with the minimum required API permissions and enforce rotation and expiration.
• Ensure credentials and signed request details are not written to URLs, logs, exceptions, or telemetry.
• Rotate any credentials previously used through command-line invocations if process or shell history may have retained them.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:110

Finding

Installation Instructions Use Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:110
Vulnerability Type: Unpinned software supply-chain dependencies
Risk Level: Medium

Vulnerable Code:

bash

pip install pymupdf pillow requests

Technical Analysis

The installation command retrieves the latest versions selected by the package index and resolver at installation time. No reviewed versions, integrity hashes, lock file, or reproducible dependency set is specified.

This does not establish that any named dependency is currently malicious. However, it permits future, compromised, or incompatible releases to enter the execution environment without corresponding review. Python packages and their transitive dependencies may execute installation-time or runtime code with the privileges of the user running pip or the Skill.

Attack Path

1. A user follows the documented installation command.
2. The package resolver selects versions available at that time rather than a reviewed dependency set.
3. A dependency account, package release, package index, or transitive dependency is compromised.
4. The malicious version is downloaded and installed.
5. Installation hooks or imported package code execute with the invoking user's privileges.

Impact Assessment

Successful supply-chain exploitation could read or modify files available to the installing user, access contract documents and cloud credentials, make network requests, or alter generated outputs. The local scope is limited by the privileges of the account or environment running the installation, but running the command with administrative privileges would increase the impact.

Remediation

View remediation

Remediation Suggestions

• Pin reviewed direct and transitive dependency versions in a lock file.
• Record and enforce cryptographic hashes using pip --require-hashes.
• Install dependencies in a dedicated virtual environment without administrative privileges.
• Use a trusted package index or controlled internal mirror.
• Automate vulnerability and provenance scanning for dependency updates.
• Review and test updates before changing the locked dependency set.
• Consider distributing a reproducible, signed environment manifest.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The tool sends full page images of scanned contracts to a third-party OCR endpoint, which may contain highly sensitive legal, financial, and personal information. In this skill context, undisclosed off-device transmission is especially dangerous because users may expect local redaction, not external processing by a cloud provider.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill describes capabilities that require network access to Alibaba Cloud OCR and local file creation for redacted PDFs/JSON, but it does not declare tool scope or permissions. In an agent environment, undeclared capabilities reduce transparency and can enable unintended data egress or file modification beyond what users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This skill processes scanned contracts, which commonly contain highly sensitive legal, financial, and personal data, and sends page images/text to Alibaba Cloud OCR. Failing to warn users about third-party transmission creates a real privacy and compliance risk because users may unknowingly disclose confidential contract contents to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented JSON output contains matched field-value pairs, which can preserve the very sensitive data the PDF redaction is meant to protect. If users assume the workflow produces only a safe redacted PDF, the sidecar JSON can become a hidden leakage channel that exposes confidential values to other users, processes, or storage systems.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module description states that the tool redacts field values, but the implementation also preserves those values in a plaintext JSON artifact. This mismatch can mislead users into believing sensitive data is being removed when it is actually being copied to another location, increasing the chance of accidental exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This request transmits contract image data to an external network service. External transmission is not inherently malicious here because OCR is the stated purpose, but it is still a real security concern in a contract-redaction tool since the uploaded material may include sensitive business and personal data.

Content

Scanner excerpt · scripts/redact_contract.py (reported line 78)May include surrounding context.

python

body = {"ImageURL": f"data:image/png;base64,{image_base64}", "OutputFigure": False}
        
        try:
            response = requests.post(url, params=params, json=body, timeout=60)
            result = response.json()
            
            if "Code" in result and result["Code"] != "Success":

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script writes extracted field values from contracts to a plaintext JSON sidecar file, which expands the tool's behavior from redaction into data retention and disclosure. Because the values being processed are precisely the sensitive items intended for redaction, this creates a clear confidentiality risk if the filesystem, logs, backups, or downstream tooling are accessed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script writes detected contract field values to disk without notifying the user that sensitive contract contents will be stored locally in plaintext. This is risky because users invoking a redaction tool may not anticipate creation of an additional sensitive artifact that can persist in work directories, backups, or shared storage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The description specifically states support for Alibaba Cloud OCR for accurate Chinese text recognition, effectively steering usage toward a single language/locale path. The file does not offer user opt-in for language handling or explain that the skill is intentionally limited to Chinese-language contract workflows.

Content

No source excerpt is available for this finding.