T08 · Insecure Dependencies
Warning
- Location
SKILL.md:12- Finding
Unpinned Third-Party Dependencies Installed from a Mutable Package Index
- Content
View full analysis
- Remediation
View remediation
Security audit
PDF Tools
Security checks for vulnerabilities and agentic risk
Overview
This PDF utility skill does what it says and shows no hidden data theft, persistence, or privilege escalation, though users should be careful with file outputs and unpinned Python dependencies.
Install only in an environment where local PDF read/write access is acceptable. Use explicit output paths, avoid reusing the original PDF path as output unless you intend to overwrite it, keep backups for important documents, and prefer a virtual environment with pinned dependency versions for pdfplumber, PyPDF2, and reportlab.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code chunk implements only a narrow subset of the declared functionality: PDF metadata and page-size inspection. It does not perform viewing, text extraction, text editing, merging, splitting, rotating, or other PDF manipulation described in the skill declaration. This is a description-behavior mismatch because the declared purpose substantially overstates the implemented capabilities and suggests a broader primary purpose than the code actually provides.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The feature list advertises editing, merging, splitting, and rotating PDFs but does not warn that these actions create or overwrite files and may modify document contents. In a skill ecosystem, missing safety guidance can lead users or orchestrators to invoke destructive or privacy-impacting operations without understanding the consequences.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README presents very broad natural-language triggers such as 'Extract text from this PDF' and 'Show me info about this PDF' and says the agent will 'automatically use the appropriate script.' In agentic environments, this can cause over-eager skill invocation on loosely related requests, increasing the chance of unintended file access or file modification without sufficiently explicit user confirmation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill advertises and documents multiple file-writing behaviors such as merging, splitting, rotating, and editing PDFs, but it does not declare an explicit tool scope like permissions or allowed-tools. That omission weakens least-privilege controls and can cause downstream agents or reviewers to underestimate that the skill can create and modify files on disk.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill documents commands that produce or modify files, but it does not clearly warn users that operations will write new PDFs, split outputs, or extracted text to disk. In an agent setting, that can lead to unintended file creation, overwrites, or confusion about persistence of generated content.
- Content
Static analysis
No suspicious patterns detected.