Security audit

PDF Converter

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed PDF conversion skill with vendor downloads and local trial tracking, but no evidence of hidden exfiltration, destructive behavior, or deception beyond documentation issues.

Install only if you are comfortable using ComPDF's commercial SDK and allowing first-run downloads from ComPDF. For offline or sensitive document workflows, pre-place license.xml and documentai.model, consider disabling AI layout with --no-enable-ai-layout when appropriate, and be aware the trial conversion count is stored locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares no required permissions, yet the documentation explicitly describes environment-variable use, reading and writing local files, and automatic network downloads. This is dangerous because operators may trust the manifest and invoke the skill in restricted environments without realizing it can reach external servers and modify local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The public description understates and misstates behavior: it omits license/model downloads, trial tracking, broader format support, image OCR behavior, and incorrectly claims XML output. Such mismatches undermine informed consent and can cause users to run software with unexpected network activity and local state changes.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The skill automatically downloads a license file and a large model from remote infrastructure during normal operation. Even if intended for functionality, unsolicited network access and local writes expand the attack surface, create supply-chain risk, and may violate offline or sensitive-environment expectations for a document-conversion tool.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The skill silently downloads a license file and AI model from remote servers at runtime, introducing undeclared network behavior and a supply-chain trust dependency. If the remote endpoint, TLS trust chain, or distribution path is compromised, the tool could ingest tampered artifacts that affect conversion behavior or expose sensitive document-processing workflows to external infrastructure.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The conversion flow performs automatic network retrieval of license and model artifacts during normal operation, which expands the attack surface beyond local document conversion. In a PDF-processing skill, this is more dangerous because users may run it on sensitive files in restricted environments and not expect external connectivity or dependency on mutable remote content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.