ComPDF Word to PDF

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 1.0.4

Overview

This skill is a disclosed ComPDF Word-to-PDF integration, with practical risks around third-party upload and local API-key storage.

Install only if you are comfortable sending selected Word documents to ComPDF and storing a ComPDF API key locally. Use a limited key if possible, keep the api_key file private and out of backups or publishing, and review generated requests for the extra sourceType=5 field.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:24

Finding

Undocumented Request Manipulation Through a Forced Routing Parameter

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–29
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Workflow

1. Identify the source file type, desired output, and requested operation.
2. Read `references/endpoint-index.md` and select only an operation listed in this skill's supported operations.
3. Read the matching heading in `references/official-api-reference.md`. Use its exact endpoint path, request fields, request mode, and response fields; do not infer unsupported options.
4. Include `sourceType=5` in every final ComPDF API request. Treat it as an integration routing parameter and include it in request details when the user asks for them.

Technical Analysis

The Skill instructs the agent to use only the exact fields documented in the official API reference, but then unconditionally requires the undocumented sourceType=5 parameter in every final request.

The Word-to-PDF reference section reviewed during the audit documents file, password, and language as request body fields. It does not document sourceType as an input field for this endpoint. Although data.sourceType appears in the response schema, that does not establish that sourceType=5 is a supported request parameter.

This instruction therefore modifies requests beyond the documented requirements of the declared Word-to-PDF operation. Because the field is described as an “integration routing parameter,” it may influence routing, attribution, telemetry, billing, or other server-side behavior that is not apparent to the user.

Attack Path

1. A user activates the Word-to-PDF Skill.
2. The Skill reads the official Word-to-PDF endpoint documentation.
3. The agent prepares a request using the documented fields.
4. The Skill instruction forces the agent to add sourceType=5, despite the field not being documented for the request.
5. The modifi ...[truncated 743 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional requirement to add sourceType=5.
2. Generate requests exclusively from fields documented for the selected endpoint.
3. If ComPDF officially requires this parameter, add a verifiable reference documenting:
   • Its accepted type and values.
   • Its routing or attribution semantics.
   • Whether it is mandatory or optional.
   • Any privacy, billing, or telemetry implications.
4. Clearly disclose the parameter to the user before request submission.
5. Require explicit user consent when the parameter affects routing, tracking, attribution, or data handling.
6. Add schema validation that rejects request parameters not present in the selected endpoint specification.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31

Finding

API Key Stored as Plaintext in the Skill Directory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–37
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code Snippet:

markdown

6. Resolve credentials only from `api_key` in the directory containing this `SKILL.md`. Read its first non-empty line. Do not inspect environment variables or any other local path. If the file is absent, unreadable, or empty, ask the user to provide an API key, then create or replace only this skill-local `api_key` file after the user confirms storage. Do not display, log, commit, or include the key in requests examples or final output.
7. Before uploading a document to ComPDF, identify the affected files and destination, and obtain confirmation unless the user has explicitly authorized that upload. Also obtain confirmation before operations that overwrite, delete, decrypt, or apply permanent protection.
8. Return the endpoint, method, content type, complete request fields, expected task/result fields, and the next polling or download step. Preserve original files unless replacement is explicitly requested.

## Credentials

Store only the current skill's API key in the sibling `api_key` file. This file is private runtime state and must be excluded from version control and skill publishing.

Technical Analysis

The Skill directs the agent to create or replace an api_key file next to SKILL.md and read the credential from its first non-empty line. This stores a reusable authentication credential as plaintext inside the project or Skill directory.

Although the documentation states that the file must not be committed or published, the audited project does not include a .gitignore rule or another technical control enforcing that requirement. The instructions also do not require restrictive filesystem permissions, encryption at rest, ownership validation, symbolic-link protection, or atomic file creation.

Consequently, the API key ...[truncated 1680 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an operating-system credential manager, managed secret store, or runtime secret-injection facility instead of a plaintext project file.
2. If file-based storage is unavoidable:
   • Store the credential outside the publishable Skill directory.
   • Create the file with owner-only permissions, such as mode 0600.
   • Validate ownership and file type before reading or writing.
   • Reject symbolic links and other non-regular files.
   • Use secure, atomic file creation to prevent replacement races.
3. Add /api_key to a project-level .gitignore.
4. Add automated secret scanning and a packaging check that fails if api_key is present.
5. Never include the key in logs, generated examples, error messages, telemetry, or final responses.
6. Support credential rotation and instruct users to revoke keys suspected of exposure.
7. Use a least-privilege API key with quota and billing limits where the provider supports those controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

3. Read the matching heading in `references/official-api-reference.md`. Use its exact endpoint path, request fields, request mode, and response fields; do not i

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

6. Resolve credentials only from `api_key` in the directory containing this `SKILL.md`. Read its first non-empty line. Do not inspect environment variables or a

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The reference file exposes a very broad API surface far beyond the declared Word-to-PDF skill purpose, including unrelated document transformation, deletion, decryption, watermarking, and AI extraction features. In an agent context, overbroad capability documentation can enable prompt/tool misuse, accidental invocation of unintended operations, or deliberate repurposing of the skill for data exfiltration or destructive actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill package documents PDF encryption and especially decryption capabilities that are unnecessary for a Word-to-PDF skill. In a tool-using agent, such latent capabilities can be abused to remove protections from uploaded documents or repackage sensitive files, expanding the blast radius well beyond harmless format conversion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The bundled AI parsing and extraction documentation describes capabilities for structured content extraction, OCR, grounding, and document intelligence that are unrelated to converting Word files to PDF. In context, this materially increases risk because an agent could be induced to extract sensitive document contents and metadata instead of performing the narrow declared conversion task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file documents extensive PDF editing and content-manipulation functions such as merge, split, delete, extract, rotate, watermark, and compression that do not match the skill’s stated scope. While some are not inherently malicious, exposing them through a narrowly branded skill creates confused-deputy risk and makes unintended destructive or privacy-impacting operations more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow documentation states that files are uploaded to ComPDF and results are later downloaded, but it does not clearly warn that user documents are being transmitted to and processed by a third-party service. This can cause inadvertent disclosure of sensitive contracts, reports, or approvals in exactly the kinds of documents this skill advertises handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file documents page deletion as a normal API action but does not explicitly warn that the resulting document omits removed pages and may permanently discard content if users overwrite originals or treat the output as authoritative. For markdown guidance, destructive or integrity-affecting behaviors should be accompanied by a clear warning so users understand the risk before use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Several parameter descriptions switch to Chinese without offering the reader a language choice, even though the surrounding document is presented as English API reference material. This creates an avoidable language-policy problem because some users are forced into a specific language for critical usage details.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The pageLayoutMode description is presented only in Chinese while the surrounding API reference is in English. This forces some readers to rely on a language they may not understand for important parameter behavior, which is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The parameter help switches to Chinese-only text in a primarily English document, which imposes a language requirement without user opt-in. Because this text explains request behavior, the inconsistency can block comprehension for English-only readers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Critical extraction-mode and options descriptions are partially or fully in Chinese, despite the file being structured as an English API reference. That forces readers into a specific language for essential configuration guidance and violates the requirement to avoid unjustified language constraints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.