T08 · Insecure Dependencies
Warning
- Location
README.md:39- Finding
Unpinned Third-Party Dependencies Allow Unreviewed Package Code Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Pdf Reader
Security checks for vulnerabilities and agentic risk
Overview
This PDF helper is not clearly malicious, but it is unfinished and saves document-derived output/history in fixed local locations without enough user control.
Review carefully before installing. Avoid sensitive PDFs unless output location and history logging are made explicit and configurable, real PDF parsing is implemented, remote API use is opt-in, and dependencies are pinned or installed in an isolated environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented behavior exceeds the declared purpose by writing outputs to a fixed local path, persisting processing history, and adding Q&A capabilities not reflected in the description. This mismatch is dangerous because it can hide privacy-impacting side effects and mislead users or reviewers about where document contents are stored or how broadly the skill may act, especially when processing sensitive PDFs.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The advertised PDF-reading behavior is not implemented: the extractor ignores the supplied file and always returns hard-coded sample content. This is dangerous because users may trust summaries, key points, and answers as if they came from their document, causing integrity failures, misinformation, and possible downstream disclosure if users act on fabricated results.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 73% confidence
- Finding
Most of the README, including usage examples and descriptions, is written only in Chinese, and the examples imply Chinese-language prompts for operation. There is no indication that users may interact in another language or that the language restriction is intentional and justified, which may conflict with a language-choice policy.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The README describes the skill as providing PDF conversion, summaries, key-point extraction, and content Q&A as current functionality. However, the development checklist later states '真实 PDF 解析（PyMuPDF）' and 'RAG 问答' are not yet completed, which indicates the documented capabilities overstate what is actually implemented.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The invocation examples use generic natural-language phrases like '处理这个 PDF' and '提取重点' without clear activation boundaries or an explicit command prefix. In agent environments, broad triggers can cause unintended execution on nearby content or ambiguous user text, increasing the risk of accidental processing of sensitive files or prompt-routing mistakes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The usage example suggests users can ask questions about the PDF content ('这篇论文讲了什么？'), implying interactive question answering is supported. Later, the development plan explicitly marks 'RAG 问答' as unchecked, which directly conflicts with the example's representation of available behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README states that processing history is automatically generated, implying persistent storage of user interaction or file metadata, but provides no warning, retention details, or consent model. This can expose sensitive document names, paths, or summaries on disk, especially in shared or synced environments.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill describes file read/write behavior and local persistence, but it does not declare a formal tool scope such as permissions or allowed-tools. This creates a least-privilege and transparency problem: hosts or reviewers cannot reliably constrain the skill's access, and users are not clearly informed of the operational boundary before sensitive files are handled.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough to activate on ordinary conversation about PDFs, increasing the chance of unintended invocation. In a skill that may read uploaded files, write outputs, or optionally use network services, accidental activation can expose document contents or initiate side effects without sufficiently specific user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly mentions file writing and optional network/API processing, but it does not provide a clear privacy notice or data-handling warning. For PDF content, which often includes confidential business, academic, or personal data, this omission can cause users to unknowingly allow local persistence or third-party transmission of sensitive information.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Natural-language strings, docstrings, prompts, and responses are written in Chinese, and the logic checks for Chinese question words to trigger behavior. There is no indication that the user can opt into another language or that the locale restriction is required for a justified regional use case.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill writes converted document content to a fixed desktop/OneDrive path unrelated to the source file or explicit user choice. This can expose potentially sensitive PDF contents to an unintended synced location, increase risk of accidental sharing, and violate user expectations about where data is stored.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Persisting PDF-derived content to a fixed desktop directory without notice or consent is a privacy and data-handling issue. In this skill context, users may process private papers or documents, and automatic saving to a visible or cloud-synced folder makes unintended disclosure more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill silently stores a local processing history including filenames, timestamps, output paths, and approximate document metrics. Even without full content, this metadata can reveal sensitive research topics, document names, workflow patterns, and local filesystem details to other local users or processes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
mainformats a success message usingresult['word_count'], implying thatprocess_pdfprovides that value, but the returned dictionary omits it. This contradicts the apparent interface promised by the calling code and causes the advertised successful processing flow to fail at runtime.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The feature description includes PDF-to-Markdown conversion, and the example output later shows a generated Markdown file path, indicating the skill writes derived content to local storage. The README does not explicitly warn users that running the skill may create output files on disk, which can affect user data and workspace contents.
- Content