T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:36- Finding
Plaintext API Credential Storage Without Enforced Access Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
ComPDF Page Editor
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed ComPDF PDF-page helper, but it bundles broader ComPDF API capabilities and stores an API key in a plaintext local file, so it should be reviewed before installation.
Install only if you are comfortable sending selected PDFs to ComPDF and storing the ComPDF API key in a local plaintext file. Keep the key low-privilege if possible, exclude api_key from version control and packaging, rotate it if exposed, and avoid using this skill for unrelated ComPDF capabilities such as decryption or AI extraction unless explicitly intended.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Read the matching heading in `references/official-api-reference.md`. Use its exact endpoint path, request fields, request mode, and response fields; do not i
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 6. Resolve credentials only from `api_key` in the directory containing this `SKILL.md`. Read its first non-empty line. Do not inspect environment variables or a
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The reference file grants an agent broad knowledge of ComPDF capabilities far beyond the declared page-editing scope, including conversion, AI extraction, encryption, decryption, watermarking, and comparison APIs. In a skill advertised only for page editing, this scope expansion materially increases the chance of over-privileged behavior, accidental misuse of unrelated endpoints, or covert data-processing actions outside user expectations.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The presence of PDF encryption and especially decryption APIs in a page-management skill creates a capability mismatch that can be abused to remove document protections or alter access controls outside the user’s expected task. Because password-protected documents are often sensitive, exposing decryption in this context raises the risk of unauthorized handling and policy bypass.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Including AI document parsing and extraction documentation in a page-editor skill exposes powerful content-understanding and data-exfiltration-adjacent capabilities that are unrelated to page management. This is especially risky because uploaded documents may contain sensitive text, and AI extraction features can transform user files into structured data far beyond what the skill description implies.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The reference includes numerous unrelated capabilities such as watermarking, compression, comparison, format conversion, and PDF generation, which broadens the operational surface far beyond page editing. While not all of these are inherently dangerous, their inclusion undermines least privilege and makes unintended or deceptive use of extra functions more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow documentation describes direct upload, async upload, and pre-signed URL flows to ComPDF without clearly warning that user files and their contents are transmitted to a third-party service. For document-processing skills, lack of explicit disclosure can cause sensitive documents to be sent off-platform without informed consent, creating privacy, compliance, and trust risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Publishing decryption examples without any cautionary framing normalizes removal of PDF protections and can encourage unsafe handling of confidential files. In the context of an agent skill, such examples may lead operators or downstream automation to treat decryption as a routine action rather than a sensitive, authorization-dependent operation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file is predominantly written in English, but some parameter descriptions switch into Chinese-only text, which imposes a locale change on readers without opt-in or justification. That creates a natural-language policy issue because users are not given a choice of language for core documentation content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section presents an English API reference but uses a Chinese-only description for the pageLayoutMode field. That forces a specific locale for part of the guidance without user choice or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These lines contain Chinese-only parameter descriptions inside an otherwise English reference, creating an inconsistent and forced locale experience. Users who rely on the English documentation are not given an alternative or explanation for the switch.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
An otherwise English section switches to Chinese-only wording for a core parameter description. This is a locale-policy concern because it forces a language assumption rather than offering user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The merge API section includes Chinese-only explanatory text for page ranges and passwords while the surrounding content is English. This inconsistent locale handling can exclude users and does not provide an opt-in language choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The split API page range description is written in Chinese only even though the surrounding documentation is English. That is a locale-policy inconsistency without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This parameter description is Chinese-only in an otherwise English reference. Users are forced into a different locale for key usage information without explanation or choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The extract-pages parameter help is Chinese-only while the rest of the section is English. This creates a language-policy inconsistency by forcing a locale change mid-document.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The watermark page-range description appears only in Chinese in a mostly English API reference. That constitutes a forced locale shift without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The remove-watermark section uses Chinese-only text for a key parameter in otherwise English content. This is a natural-language policy issue because it assumes a specific language without offering alternatives.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
A Chinese-only OCR language description is embedded in an English AI parsing section. This forces a locale on users without documented justification or opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This block contains multiple Chinese-only descriptions for extraction parameters inside a predominantly English document. The content forces a specific locale for important operational guidance without user choice, which matches the language/locale policy concern.
- Content