技术宣发助手

• Outcome: Review
• Latest audit: May 28, 2026 · 2:49 PM UTC
• Version: 1.0.0

Overview

The skill largely does what it advertises, but users should review it because it can install Python packages and may automatically use local image API keys to send report-derived prompts to third-party services.

Install only if you are comfortable with local Python execution, possible pip installation, and output files containing extracted report content. For confidential or unpublished PDFs, use --no-image unless you explicitly want external image APIs involved, run it in a virtual environment or sandbox, and review/delete the generated output directory afterward.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tainted flow: 'image_url' from requests.post (line 105, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

if isinstance(image_url, list):
        image_url = image_url[0]

    img_data = requests.get(image_url, timeout=60).content
    os.makedirs(os.path.dirname(output_path) or ".", exist_ok=True)
    with open(output_path, "wb") as f:
        f.write(img_data)

• Confidence: 89% confidence
• Finding: The script trusts a URL returned by the Replicate API response and fetches it directly with requests.get, without validating scheme, host, or content type. If the upstream service, a compromised response path, or an attacker-influenced model output returns an unexpected URL, this can turn the tool into a server-side request forgery or unwanted internal network fetch primitive.

Tainted flow: 'image_url' from requests.post (line 105, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

result = resp.json()

    image_url = result["data"][0]["url"]
    img_data = requests.get(image_url, timeout=60).content
    os.makedirs(os.path.dirname(output_path) or ".", exist_ok=True)
    with open(output_path, "wb") as f:
        f.write(img_data)

• Confidence: 89% confidence
• Finding: The code takes image_url from the OpenAI API response and performs a second outbound request without verifying the destination. This creates trust-on-first-use of a network-provided URL and can enable SSRF-style behavior or retrieval of unexpected content if the URL is malformed, redirected, or attacker-controlled through an upstream compromise.

Tainted flow: 'image_url' from requests.post (line 105, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

result = resp.json()

    image_url = result["data"][0]["url"]
    img_data = requests.get(image_url, timeout=60).content
    os.makedirs(os.path.dirname(output_path) or ".", exist_ok=True)
    with open(output_path, "wb") as f:
        f.write(img_data)

• Confidence: 88% confidence
• Finding: The Ark provider flow blindly downloads from a URL supplied in the API response and writes the bytes to disk. Without host validation and download safeguards, a malicious or compromised upstream response could cause SSRF-like internal requests or download arbitrary large/unexpected content.

Tainted flow: 'poll_url' from requests.post (line 88, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

waited += 3
        if waited > max_wait:
            raise TimeoutError(f"Image generation timed out after {max_wait}s")
        prediction = requests.get(poll_url, headers=headers, timeout=30).json()

    if prediction["status"] != "succeeded":
        error = prediction.get("error", "Unknown error")

• Confidence: 86% confidence
• Finding: The polling URL is taken from the initial API response and then fetched directly, again without validating the target host. If that response were tampered with or the provider returned an unexpected URL, the script could be induced to make requests to arbitrary destinations with the Authorization header attached, increasing the severity beyond a simple fetch.

Tainted flow: 'headers' from os.environ.get (line 201, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

waited += 3
        if waited > max_wait:
            raise TimeoutError(f"Image generation timed out after {max_wait}s")
        prediction = requests.get(poll_url, headers=headers, timeout=30).json()

    if prediction["status"] != "succeeded":
        error = prediction.get("error", "Unknown error")

• Confidence: 93% confidence
• Finding: Here the Authorization header containing the Replicate token is reused when requesting poll_url obtained from a prior network response. Because the destination URL is not validated, a malicious or compromised response could redirect the client to an attacker-controlled host and leak the bearer token, enabling unauthorized API use.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to probe environment variables for API keys and conditionally use them, but it does not explicitly warn the user that their local credentials may be accessed during execution. In an agent setting, silent credential discovery expands trust boundaries and can surprise users, especially because the skill also has shell and network capabilities that could use those secrets in downstream calls.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# PDF 解析
pdfplumber>=0.10.0
PyMuPDF>=1.23.0

# HTTP 请求 (图片生成 API)

• Confidence: 95% confidence
• Finding: Using a lower-bounded dependency like pdfplumber>=0.10.0 allows future installations to resolve to different, unreviewed versions over time. This weakens build reproducibility and can silently introduce vulnerable or incompatible releases into the skill's PDF-processing pipeline.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# PDF 解析
pdfplumber>=0.10.0
PyMuPDF>=1.23.0

# HTTP 请求 (图片生成 API)
requests>=2.31.0

• Confidence: 96% confidence
• Finding: PyMuPDF is specified with a non-exact version constraint, so installs may pull newer versions without review. Because this skill processes untrusted PDF input, lack of pinning increases exposure to supply-chain risk and unexpected security regressions in a parser-facing dependency.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

PyMuPDF>=1.23.0

# HTTP 请求 (图片生成 API)
requests>=2.31.0

# 图片处理
Pillow>=10.0.0

• Confidence: 97% confidence
• Finding: requests>=2.31.0 permits non-deterministic dependency resolution and may introduce vulnerable or behavior-changing releases at install time. Since the skill may call external image-generation APIs, this can affect outbound HTTP security, credential handling, and trust boundaries.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0

# 图片处理
Pillow>=10.0.0

# 可选: OCR (扫描型 PDF)
# pytesseract>=0.3.10

• Confidence: 96% confidence
• Finding: Pillow>=10.0.0 allows arbitrary later versions to be installed without prior review. For a skill that may generate or process images, this creates avoidable supply-chain and stability risk, especially in a media-parsing library with a history of security issues.

Known Vulnerable Dependency: PyMuPDF — 1 advisory(ies): CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)

Low

• Category: Supply Chain
• Confidence: 63% confidence
• Finding: The finding indicates PyMuPDF has an advisory for path traversal in its _main_.py, but the requirements file alone does not prove the vulnerable code path is exercised. Still, declaring an affected package in a skill that ingests attacker-controlled PDFs increases risk if CLI or helper entry points are used anywhere in the project.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: requests is flagged with multiple advisories, including credential leakage and verification-related issues, and this skill is explicitly designed to make HTTP requests to image-generation APIs. In that context, using an affected or loosely constrained HTTP client can expose secrets, mishandle TLS or redirects, and leak sensitive data to attacker-controlled endpoints.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: Pillow has multiple serious historical advisories, including potential arbitrary code execution and resource-consumption flaws, and this skill may process or generate images from external content. In an image-handling workflow, an exposed vulnerable imaging library can be a direct attack surface for malicious files or payloads returned by third-party services.

Static analysis

No suspicious patterns detected.