Security audit

ComPDF PDF To Word

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed ComPDF PDF-to-Word helper, but users should understand it reads a local API key and sends selected documents to ComPDF for processing.

Install this only if you are comfortable with selected PDFs being uploaded to ComPDF and processed under your ComPDF account. Use it for PDF-to-Word conversion only, keep the local API key file private, and avoid using it on sensitive documents unless your organization permits ComPDF processing and temporary download links.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill directs the agent to read a local API key file and make external API requests, but it declares no permissions or capability boundaries. This creates a trust and transparency gap: an agent or platform may execute file-read/network behavior that users did not explicitly authorize, increasing the chance of unintended secret access or document exfiltration to a third-party service.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 82% confidence
Finding: The skill is presented as a narrowly scoped PDF-to-Word helper, but the maintainer instructions and referenced behavior indicate broader network scraping, local file generation, and coverage of many unrelated APIs. This mismatch is dangerous because reviewers and users may approve the skill under a limited-use assumption while it actually supports a much wider operational surface, making misuse, overcollection, or unexpected external interactions more likely.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill is described as a narrowly scoped PDF-to-Word capability, but the referenced endpoint index exposes a much broader API surface including file conversion, PDF modification, AI parsing/extraction, encryption/decryption, and webhooks. This creates scope expansion risk: an agent or downstream component could select unintended endpoints, causing over-privileged behavior, unexpected data handling, or policy bypass relative to the user-facing purpose of the skill.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The reference file documents a very broad API surface far beyond the skill's stated PDF-to-Word purpose, including file transformation, document mutation, security operations, and AI extraction. In an agentic skill context, this expands the reachable capability set and increases the chance the skill or downstream prompts invoke unintended high-risk actions on user documents.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Including encryption and especially decryption capabilities in a PDF-to-Word skill exposes security-sensitive operations unrelated to the advertised function. If an agent can discover and use these endpoints, it may remove protections from documents or alter their security posture without clear user intent.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The file includes AI document parsing and extraction APIs that can pull structured data from uploaded files, which is materially more sensitive than simple format conversion. In a PDF-to-Word skill, this creates a risk of over-collection, unintended data extraction, and privacy-impacting use of uploaded documents beyond the user's expected task.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation describes uploading files to a third-party ComPDF service but does not prominently warn that user documents leave the local environment and are stored/processed externally, with downloadable result URLs retained temporarily. This can mislead users about data handling and cause unintended disclosure of sensitive contracts, reports, or forms.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The decryption section explains removal of password protection without a strong warning about the sensitivity of stripping protections from files. In an agent context, understated documentation can normalize or enable use of a high-risk operation that changes document confidentiality expectations.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.