Security audit

ComPDF Encryt PDF Decrypt PDF

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed ComPDF helper for encrypting or authorized-decrypting PDFs, with appropriate cautions around passwords, API keys, file uploads, and confirmation.

Install only if you are comfortable sending selected PDFs and passwords to ComPDF for processing. Use a dedicated ComPDF API key file, avoid highly sensitive documents unless your organization permits this service, and keep the agent constrained to the two declared operations: encrypt PDF and authorized decrypt PDF.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill instructs the agent to read local files for API keys and to perform networked API operations, yet it declares no permissions. This creates a transparency and governance gap: operators may approve or deploy the skill without realizing it can access sensitive local secrets and send documents externally, increasing the chance of unintended data exposure.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The reference file exposes a full ComPDF platform surface even though the skill is presented as an encrypt/decrypt-only capability. In an agent setting, this creates dangerous scope expansion: the model can be induced to invoke unrelated conversion, editing, generation, comparison, or AI extraction endpoints using user-supplied documents, violating least privilege and potentially causing data exfiltration or unauthorized content transformation.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Including AI parsing and extraction docs in an encryption/decryption skill materially increases risk because those endpoints can extract structured content from uploaded documents, not merely protect them. In the context of a security-focused skill, this mismatch is especially dangerous because users may trust the skill with sensitive files, while the agent could be steered into content-mining operations beyond user expectations.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The file documents broad document-conversion capabilities unrelated to the declared purpose of PDF encryption/decryption. This unnecessary capability sprawl increases the chance of prompt-induced misuse, accidental document disclosure to third-party processing endpoints, and user deception about what the skill can actually do with uploaded files.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The reference includes editing and content-modification operations such as merge, split, delete, extract, insert, watermarking, compression, and comparison, all outside the stated security purpose. For a skill users may trust to only protect or unprotect PDFs, these functions enable silent alteration of document contents or structure, increasing integrity and privacy risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation describes uploading user documents to a third-party API but does not prominently warn about privacy, retention, regional transfer, or sensitivity implications. In a PDF security skill, this omission is more dangerous because users may submit confidential documents under the assumption that the skill only performs local-style protection operations rather than transmitting content to an external processor.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The webhook section explains callbacks without clearly warning that task metadata will be transmitted to user-specified external endpoints. While the example only shows task/file identifiers, in an agent workflow this can still leak processing metadata or create SSRF-style risks if arbitrary callback URLs are allowed downstream.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.