Security audit

ComPDF Watermark Manager

Security checks across malware telemetry and agentic risk

Overview

This skill is scoped to ComPDF PDF watermark tasks and does not show hidden malware-like behavior, but it sends documents to an external service and ships broader reference docs than it needs.

Install only if you are comfortable storing a ComPDF API key locally and sending selected PDFs to ComPDF for processing. Use it for authorized watermark add/remove work, and be cautious with confidential, regulated, or third-party documents. The publisher should ideally trim the bundled reference to watermark-specific pages to reduce confusion.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to read a local API key file, interact with external ComPDF endpoints, and potentially refresh local reference सामग्री, but it declares no permissions for file access or network use. This mismatch is dangerous because it hides sensitive capabilities from the permission model and user review, increasing the risk of unintended secret access or outbound data transfer without clear consent boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a narrow watermark-management tool, but the described behavior and maintainer workflow indicate broader documentation fetching, scraping, local snapshot generation, and exposure to many unrelated ComPDF APIs, including sensitive operations like encryption and extraction. This broadening is dangerous because users may trust the skill with documents under the assumption of limited watermark-only scope while the implementation path enables more expansive network activity and selection of higher-risk document-processing actions.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The reference file exposes a much broader API surface than the skill’s declared watermark-only purpose, including conversion, OCR, AI extraction, encryption/decryption, and document editing operations. In an agent setting, this creates dangerous capability confusion: downstream tool selection or prompt injection could steer the agent into invoking unrelated high-risk actions while the user believes they enabled only watermark handling.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Including AI document parsing and extraction APIs in a watermark skill unnecessarily grants access to full document-content extraction, OCR, and structured data harvesting. That materially increases confidentiality risk because sensitive uploaded PDFs could be parsed and exfiltrated under the guise of a simple watermark task.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: PDF encryption and especially decryption are unrelated to watermark operations and expand the skill into access-control bypass and document protection removal territory. In context, a user enabling a watermark tool would not reasonably expect it to be able to remove passwords or alter document permissions.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Broad document conversion capabilities are outside the stated watermark-only purpose and increase the chance of unauthorized transformations, content extraction, and accidental data disclosure to external services. While not inherently malicious, this mismatch weakens least-privilege boundaries and makes agent misuse more likely.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Unrelated PDF editing, generation, and manipulation features expand the skill beyond its declared function and permit destructive or privacy-impacting actions such as page deletion, extraction, insertion, and generated content creation. In an agent environment, extra capabilities widen the blast radius of mistakes or adversarial prompts.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation describes uploading files to ComPDF but does not clearly warn users that documents and potentially extracted contents are transmitted to an external third-party service. For document workflows, that omission is security-relevant because users may unknowingly send confidential, regulated, or proprietary files off-platform.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.