Security audit

Pdf Reader

Security checks across malware telemetry and agentic risk

Overview

This skill looks like an incomplete PDF-reader prototype that can mislead users by returning sample content while also saving files and history locally.

Treat this as a prototype, not a reliable PDF reader. Do not use it for private, regulated, or decision-critical PDFs unless the PDF parsing is implemented, the output location is changed or confirmed by the user, and history logging can be reviewed or disabled.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill's short description understates behaviors that affect user data handling, including persistent local history storage, writing output to a fixed external directory, and document Q&A over uploaded content. This is dangerous because users may provide sensitive PDFs expecting transient analysis, while the skill design implies data retention and filesystem writes outside the skill boundary without clear up-front disclosure.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The README materially overstates implemented capabilities by advertising PDF-to-Markdown, summarization, and content QA while the development checklist says real PDF parsing is not yet implemented. This can mislead users into trusting outputs, deploying the skill in workflows that assume accurate document processing, or handling sensitive PDFs under false assumptions about functionality and data handling.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The advertised PDF-reading capability is not implemented: the extraction function returns hardcoded sample text regardless of the user-supplied file. This is dangerous because it deceives users about what data was processed, causing silent integrity failures and potentially unsafe downstream decisions based on fabricated output presented as document-derived analysis.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The skill persists output Markdown and history data to local disk even though its description emphasizes reading and analysis. This creates an undisclosed data-retention surface for potentially sensitive document contents and metadata, increasing privacy and confidentiality risk if the host system is shared, synced, or compromised.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The invocation examples use vague natural-language commands like '处理这个 PDF' and '提取重点' without defining activation boundaries, required parameters, or confirmation steps. In an agent environment, overly broad triggers can cause unintended execution on the wrong file or unexpectedly process sensitive documents when similar phrases appear in normal conversation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README states that processing history is automatically generated, but it does not warn users that document-related metadata may be persisted to disk. For a PDF-reading skill, this is especially sensitive because filenames, paths, summaries, or derived content may reveal confidential information and create an unexpected privacy or compliance risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The permissions section acknowledges file writing and optional network/API usage but does not warn that uploaded PDFs may contain confidential information and that outputs or extracted content could be stored or transmitted. In context, this increases privacy and data-governance risk because users may not realize their documents can be persisted locally or sent to third-party services.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The example demonstrates saving converted content to a specific local desktop path, which normalizes persistent export outside the skill workspace without warning or consent language. This is risky because converted Markdown can contain sensitive document contents and writing to a predictable user directory can expose data to other local processes, backups, or accidental sharing.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documented history.json retains filenames, dates, page counts, output paths, and summaries of processed PDFs without any privacy notice, retention controls, or minimization. Even if intended for convenience, persistent metadata and summaries can leak sensitive business, research, or personal information long after processing is complete.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code writes converted document content to a local Markdown file without clear user disclosure at the interface layer. For PDF workflows, the processed files may contain sensitive personal, financial, or business information, so undisclosed persistence can expose data beyond the user's expectation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill stores processing history including filenames, timestamps, paths, and derived metadata without user-facing disclosure. Even when full document text is not retained in history, this metadata can still reveal sensitive activity, document names, and storage locations, which may be valuable to an attacker or inappropriate in regulated environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.