ComPDF Conversion CLI

• Outcome: Pass
• Latest audit: Jun 24, 2026 · 6:05 AM UTC
• Version: 1.2.0

Overview

This PDF conversion skill has network downloads and local trial tracking, but those behaviors fit the stated converter purpose and are mostly disclosed.

Install only if you are comfortable with a commercial ComPDF-based converter that may download vendor license/model files on first use and write a local trial-usage counter. For confidential, regulated, or offline work, pre-provision required assets if possible, review the vendor terms, and avoid using it when unexpected network access or local persistence is unacceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no required permissions while its documented behavior includes environment-variable access, reading and writing local files, and downloading remote resources. This is dangerous because agents or users may invoke it assuming a low-privilege local conversion tool, when it actually performs network access and persistent filesystem changes, reducing transparency and informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The public description frames the skill as a document conversion utility, but the documented behavior additionally performs remote downloads, license verification, trial-usage tracking in the user's home directory, and purchase-enforcement logic. That mismatch is dangerous because it conceals data flows and side effects that affect privacy, network policy, reproducibility, and trust boundaries; users may supply sensitive documents without realizing external dependencies and local persistence are involved.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script silently downloads a license file and Document AI model from remote servers during normal conversion flow, despite presenting itself as a local conversion CLI. This creates an undisclosed data-flow and supply-chain risk: execution now depends on external content that could change, fail, or be tampered with, and users may unknowingly trigger network activity in sensitive environments.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The tool persistently writes usage-tracking data under the user's home directory without clear disclosure or consent. While not directly enabling code execution, this exceeds the stated conversion purpose and can violate user expectations, privacy boundaries, or environment immutability assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The download_file helper gives the converter outbound network capability to fetch external resources at runtime. In a document-conversion skill, this broadens the trust boundary and introduces availability, privacy, and supply-chain concerns, especially in restricted or high-assurance environments where file conversion is expected to remain local.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger language is extremely broad ('MUST use for ANY PDF or image format conversion task' and takes priority over many other document skills), which can cause the agent to invoke this skill in situations where a simpler, offline, or safer local handler would suffice. In context, this increases risk because invocation of this skill carries hidden network downloads, OCR/AI processing, and file writes, so over-triggering expands exposure of potentially sensitive document contents and system state.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill documentation does not prominently warn, at the point users would decide to use it, that it automatically downloads a license file and a large OCR/AI model and may process document contents with OCR/AI features enabled by default. This is dangerous because users may unknowingly trigger network egress and additional document analysis on sensitive files, especially in restricted or regulated environments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code automatically downloads the AI model without a meaningful user warning beyond stderr status text emitted during the operation. Lack of upfront disclosure is dangerous because users may run the skill in regulated, offline, or confidential settings where unexpected network access is itself a policy violation.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script creates and overwrites a usage.json file in the user's home directory automatically, with no clear disclosure before doing so. This is primarily a transparency and least-surprise issue, but it can still cause problems in locked-down environments or where persistent writes are not permitted.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.