Paper Parse

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:20 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward PDF-to-Markdown parser that writes expected output files, with dependency and output-directory cautions.

Installers should understand that the skill processes local PDFs and writes Markdown, JSON, and PNG outputs to the selected output directory. For stronger reproducibility, pin or lock the uv dependencies and run it in a workspace where the chosen output path cannot overwrite important files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/parse_paper.py:2

Finding

Automatically Resolved Third-Party Dependencies Are Not Reproducibly Pinned

Content

View full analysis

Vulnerability Details

File Location: scripts/parse_paper.py:2-7
Related Documentation: SKILL.md:54-58
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

python

# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "PyMuPDF>=1.23.0",
#     "pymupdf4llm>=0.0.10",
# ]
# ///

The related documentation states:

markdown

## Dependencies

- PyMuPDF (fitz) - PDF parsing and rendering
- pymupdf4llm - Markdown conversion

These are automatically managed by uv via the inline script metadata.

Technical Analysis

The inline dependency metadata specifies only minimum versions. It does not provide exact reviewed versions, integrity hashes, a committed lockfile, or a restricted package source. Consequently, the documented uv run workflow may resolve and install any future package release that satisfies these constraints.

Python dependencies execute inside the invoking process when imported and may also run installation or build-related code depending on the resolved distribution. This means the effective code executed by the Skill can change after the Skill itself has been reviewed. It also makes builds non-reproducible: two executions at different times may resolve materially different dependency versions.

This finding does not establish that either named dependency is currently malicious. The risk arises from permitting automatically selected, unreviewed future versions and relying on the package distribution channel without a reproducible dependency lock.

Attack Path

1. An attacker compromises a future release of PyMuPDF or pymupdf4llm, an associated maintainer account, or the package distribution channel.
2. The compromised release retains a version satisfying the declared lower-bound constraint.
3. A user invokes the documented command through uv run in an environment where dependencies are not already locked and cached.
4. uv resolves and installs th ...[truncated 1095 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to an exact, reviewed version rather than using open-ended minimum constraints.
2. Generate and commit a uv.lock file so dependency resolution is reproducible.
3. Run the Skill with uv run --locked or uv run --frozen to prevent silent dependency updates.
4. Verify downloaded artifacts using integrity hashes or an organization-controlled package mirror.
5. Restrict package resolution to trusted indexes and disable unapproved supplemental indexes to reduce dependency-confusion exposure.
6. Introduce a controlled dependency-update process that includes vulnerability scanning, release review, automated tests, and explicit lockfile updates.
7. Execute PDF parsing in a sandbox or container with minimal filesystem access, no unnecessary credentials, and network access disabled unless explicitly required.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill writes parsed markdown, JSON, and extracted images to disk, but the manifest does not declare any tool scope such as explicit file-write permissions or allowed tools. This creates a trust and containment gap: consumers cannot easily evaluate or restrict the skill's write behavior, and an agent framework may permit broader filesystem effects than intended.

Content

No source excerpt is available for this finding.