T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:32- Finding
API Key Persisted in an Unprotected Plaintext File
- Content
View full analysis
- Remediation
View remediation
Security audit
ComPDF Encrypt & Decrypt PDF
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly scoped to ComPDF PDF encryption and decryption, but it needs review because it can steer users into obsolete RC4 encryption and stores the ComPDF API key in a local plaintext file.
Install only if you are comfortable sending PDFs and document passwords to ComPDF and storing the ComPDF API key locally. Prefer AES-256 explicitly for new encryption, avoid RC4 unless you have a narrow legacy requirement, and protect or rotate the API key if the skill directory may be synced, shared, or published.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/official-api-reference.md:7020- Finding
Obsolete RC4 Encryption Is Supported, Defaulted, and Demonstrated
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Read the matching heading in `references/official-api-reference.md`. Use its exact endpoint path, request fields, request mode, and response fields; do not i
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 6. Resolve credentials only from `api_key` in the directory containing this `SKILL.md`. Read its first non-empty line. Do not inspect environment variables or a
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The reference file exposes a much broader capability surface than the skill metadata advertises, including conversion, editing, AI extraction, and comparison endpoints. In an agent setting, this mismatch can enable unintended or covert use of high-impact actions on user documents under the cover of a narrowly described encrypt/decrypt skill.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Documenting broad document-conversion APIs in an encrypt/decrypt skill creates unnecessary privilege expansion and a misleading trust boundary. An agent could leverage these extra endpoints to transform or export user content into easier-to-exfiltrate formats unrelated to the stated purpose.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Including AI document parsing and extraction APIs in a skill presented as PDF security materially expands access from access-control operations into full content extraction. That creates a risk of sensitive-document exfiltration or overcollection, especially because these endpoints can process uploaded files and return structured extracted data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation describes uploading user files to a third-party ComPDF API but does not clearly warn users that document contents leave the local environment and are stored/processed externally. For document-security workflows, this omission is especially risky because users may assume encryption-related handling is local or privacy-preserving by default.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
PDF editing and content-modification features such as delete, extract, insert, watermark, and compression exceed the stated access-protection purpose and broaden the blast radius of misuse. In an agentic workflow, these actions can silently alter, strip, or repackage user documents in ways the user did not intend.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file documents operations such as page deletion and decryption/removal of protections as standard features, but it does not include a caution that these actions alter document contents or protections and may be irreversible if originals are not retained. For markdown guidance, safety-relevant behaviors that affect user data integrity should be accompanied by explicit warnings.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Several parameter descriptions switch from English to Chinese-only text inside an otherwise English reference, which can prevent users from understanding operational details unless they know Chinese. This is a natural-language locale policy issue because the file does not offer a language choice or clearly justify the locale-specific constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This line is one of multiple Chinese-only parameter descriptions embedded in the English reference, creating inconsistent accessibility for users who expect a single language. Because no opt-in or locale selection is provided, this conflicts with the requirement to avoid forcing a specific language unexpectedly.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The extraction-mode and options descriptions are partially or fully in Chinese, despite the surrounding content being English. Users are not given an explicit choice of locale, so critical usage details become accessible only to readers of one language.
- Content