Deposition Question Development

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:01 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed legal-document workflow that reads user-provided PDFs, extracts page text and document IDs, and helps draft deposition questions; its main caution is an unpinned Python dependency.

Install only in a project virtual environment if possible, pin or review `pdfplumber`, and run the extraction only against intended case PDFs. Treat the generated JSON as sensitive because it contains extracted legal document text.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:64

Finding

Unpinned pdfplumber Dependency in Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64-69
Vulnerability Type: Unpinned third-party Python dependency
Risk Level: Medium

markdown

## Dependencies

Install once if missing:

```bash
python -m pip install --user pdfplumber

text

### Technical Analysis

The installation command does not specify an audited version, validate package hashes, use a lockfile, or require an isolated virtual environment. Package resolution therefore depends on the state of the configured Python package index at installation time and may select a newly published or compromised `pdfplumber` release or transitive dependency.

The `--user` option installs the package under the invoking user's account. It does not grant administrative privileges, but package build hooks and subsequently imported package code can execute with that user's permissions. The extraction script imports `pdfplumber` and uses it to process potentially sensitive legal documents, making the integrity of the dependency particularly important.

### Attack Path

1. An attacker compromises a resolved dependency release, its distribution account, or the package source configured in the user's pip environment.
2. The user follows the documented `python -m pip install --user pdfplumber` instruction.
3. Pip resolves and installs the attacker-controlled release because no version or cryptographic hash is enforced.
4. Malicious code executes during an applicable source-build process or when the extraction script imports and invokes the installed package.
5. The code operates with the invoking user's permissions and may access the PDFs, extracted legal content, output files, environment variables, and other resources available to that user.

This path depends on package-index, publisher, dependency, or local pip-configuration compromise; the audited project itself does not contain a malicious dependency payload.

### Impact Assessment

Successful ex
...[truncated 383 chars]

Remediation

View remediation

Remediation Suggestions

• Pin pdfplumber and every transitive dependency to audited versions in a dependency lockfile.
• Require cryptographic hashes, for example with python -m pip install --require-hashes -r requirements.txt.
• Generate and review the lockfile from a trusted package index, and update dependencies through a controlled review process.
• Install dependencies in a dedicated virtual environment rather than the user-wide package directory.
• Configure pip to use an explicitly trusted index and disable unexpected additional indexes.
• Run PDF extraction in a sandbox or container with access restricted to required input PDFs and the designated output directory.
• Add automated dependency vulnerability and provenance checks to release validation.

T08 · Insecure Dependencies

Warning

• Location: README.md:51

Finding

Unpinned pdfplumber Dependency in User Documentation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 51-57
Vulnerability Type: Unpinned third-party Python dependency
Risk Level: Medium

markdown

## Dependency

Install once if missing:

```bash
python -m pip install --user pdfplumber

text

### Technical Analysis

The README repeats an installation command that leaves dependency versions and artifact integrity unconstrained. No exact version, lockfile, package hash, or isolated environment is specified. Consequently, two users following the same documentation at different times may receive different package or transitive-dependency versions.

Because the installed library is later imported by the extraction script and receives access to sensitive PDF content, compromise of the dependency supply chain could turn normal document extraction into user-level code execution or data exposure.

### Attack Path

1. A malicious or compromised release becomes available through the package index or other source selected by the user's pip configuration.
2. A user follows the README installation command.
3. Pip resolves the uncontrolled package and dependency versions without hash verification.
4. Attacker-controlled code runs through an applicable build hook or when `pdfplumber` is imported and used.
5. The code can interact with resources available to the invoking user, including source PDFs and generated JSON output.

Exploitation requires compromise or malicious control of a resolved package source, release, or dependency. No direct remote payload retrieval logic is present in the project script itself.

### Impact Assessment

The maximum direct privilege is that of the invoking user. Potential effects include arbitrary user-level code execution, theft or alteration of confidential legal documents, manipulation of extracted evidence, and access to other user-readable local data. No administrative privilege escalation or persistence mechanism was identifi
...[truncated 3 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the unversioned command with installation from a reviewed, hash-locked requirements file.
• Document creation and activation of a project-specific virtual environment.
• Pin both direct and transitive dependencies and verify downloaded artifacts using --require-hashes.
• Use a trusted, explicitly configured package index and prohibit unreviewed extra indexes.
• Document a controlled dependency-update procedure with security scanning and regression testing.
• Recommend processing untrusted PDFs in a least-privilege sandbox with narrowly scoped filesystem access.

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The implemented script only performs a preprocessing/extraction step: reading PDFs, extracting page text, identifying bottom-right numeric IDs, and outputting structured JSON. While this aligns with one sub-part of the description (per-page document ID extraction, including choosing the smaller of two numbers), it does not carry out the main declared purpose of legal analysis and deposition-question drafting based on a legal theory. The primary behavior is materially narrower and different from the declared end-to-end skill.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

- Follow `references/deposition_output_template.md`.
   - Keep document IDs in ascending numeric order.

## Output Rules

- Do not merge different document IDs into one section.
- Do not omit `Reason` or `Quote` sections under any question.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to run local scripts and install dependencies, but it does not declare any explicit tool scope or permissions. That creates a governance gap: an agent may be granted broader file-write or execution capability than users expect, increasing the chance of unintended filesystem modification or package installation during use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.