T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/convert.py:77- Finding
Predictable Shared Temporary Files Permit Local File Clobbering
- Content
View full analysis
- Remediation
View remediation
Security audit
Pdf Converter
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent PDF conversion skill, but its install guidance and temporary-file handling create review-worthy local environment and file-safety risks.
Install only if you are comfortable with a local PDF converter that writes converted files to disk and uses third-party PDF libraries. Prefer using a virtual environment instead of the documented --break-system-packages commands, avoid running conversion as root or administrator, and be careful with sensitive PDFs until the temporary-file handling is fixed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
INSTALL.md:24- Finding
Unpinned Dependencies Are Installed into the System Python Environment
- Content
View full analysis
- Remediation
View remediation
\ --hash=sha256: python-pptx== \ --hash=sha256: pdf2docx== \ --hash=sha256: Pillow== \ --hash=sha256: ``` Actual versions and hashes should be selected after compatibility testing and artifact review; they should not be invented. 3. Remove `--break-system-packages` from `SKILL.md`, `INSTALL.md`, `EXAMPLES.md`, `scripts/check_deps.py`, and `scripts/convert.py`. 4. Use `python -m pip` from the activated virtual environment to ensure packages are installed for the intended interpreter. 5. Review transitive dependencies and regenerate the lock file through a controlled update process. 6. Run dependency vulnerability and provenance checks in continuous integration. 7. Configure trusted package indexes explicitly in deployment policy rather than relying on an unknown user-level pip configuration. ]]>
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (20)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
该文档从标题开始即以中文提供全部安装说明，未见任何语言选择、双语支持或对仅限中文的明确说明。根据规则，强制特定语言且没有用户选择或合理限定，属于自然语言层面的语言/地区策略违例。
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu/Debian:
bash sudo apt-get install poppler-utilsWindows:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu/Debian:
bash sudo apt-get install poppler-utilsWindows:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu/Debian:
bash sudo apt-get install poppler-utilsWindows:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu/Debian:
bash sudo apt-get install poppler-utilsWindows:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu/Debian:
bash sudo apt-get install poppler-utilsWindows:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Ubuntu/Debian:
bash sudo apt-get install poppler-utilsWindows:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Natural-language guidance throughout the skill is presented only in Chinese, including usage instructions and troubleshooting. Per the policy, forcing a specific language without user opt-in or justification is a locale-policy violation unless the skill clearly offers alternatives or documents a justified region-specific scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This Python file contains user-facing docstrings and printed messages entirely in Chinese, including status output and installation instructions. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a locale/language policy issue when no alternative or justification is provided.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python import_name = package_name try: __import__(import_name) return True except ImportError: return False
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def check_poppler(): """检查 poppler 是否已安装""" try: result = subprocess.run(['which', 'pdfinfo'], capture_output=True, text=True) return result.returncode == 0 except:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file contains natural-language strings that force a specific language for usage instructions, error messages, and help output. Under the policy, language restrictions should either offer user opt-in/choice or be explicitly justified as region-specific.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python print(" pip3 install --break-system-packages pdf2image python-pptx pdf2docx Pillow") print("\n还需要安装 poppler:") print(" macOS: brew install poppler") print(" Ubuntu: sudo apt-get install poppler-utils") sys.exit(1)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python print(" pip3 install --break-system-packages pdf2image python-pptx pdf2docx Pillow") print("\n还需要安装 poppler:") print(" macOS: brew install poppler") print(" Ubuntu: sudo apt-get install poppler-utils") sys.exit(1)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's description and usage messages are entirely in Chinese, and there is no indication that language selection is optional or that the tool is intentionally limited to a Chinese-speaking context. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file uses Chinese throughout headings, instructions, examples, and FAQs, which effectively imposes a specific language on users. Under the policy rule, language constraints should either be optional for users or explicitly justified as region-specific.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This is a markdown file, so SQP-2 applies to omissions in user-facing warnings. The usage section shows commands that generate converted files, including batch mode, but does not explicitly disclose that the skill will create output files on disk and may produce multiple files when run on a directory.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file documents that outputs are written either to a specified path or, by default, alongside the source PDF, and also supports batch conversion. Because file creation can affect user data locations and disk contents, the skill description should explicitly warn users that running it will create new PPTX/DOCX files, especially in batch mode.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The
logmethod is documented and implemented as taking only a singlemessageargument, yetbatch_convertcallsself.log(f"[{i}/{len(pdf_files)}] ", end="")at L178 as if it were aprint-like wrapper supporting keyword arguments. This is an intent/code divergence because the surrounding code treats the helper as having behavior it does not actually implement, leading to a runtime failure in batch mode.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
This code invokes a converter to transform the input PDF into a PPTX or DOCX, which likely creates a new file on disk. In this file there is no explicit confirmation, user-facing notice, or comment warning that the operation will write output files, so the file-writing behavior is not disclosed here.
- Content
Static analysis
No suspicious patterns detected.