Security checks for vulnerabilities and agentic risk
Overview
The PDF skill is mostly a coherent document utility, but HTML-to-PDF generation can fetch local or network resources without an explicit safety boundary.
Install only if you will use it on PDFs, HTML, Markdown, and CSS you trust. Avoid converting attacker-supplied HTML unless the renderer is sandboxed or updated to block file:// URLs and private/internal network fetches.
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T09 · Insecure Skill Coding Practices
Warning
Location
scripts/pdf_generate.py:25
Finding
Unrestricted Resource Fetching in HTML-to-PDF Conversion
Content
View full analysis
if markdown lib not available
html_content = f"text
{content}
"
print("Warning: 'markdown' package not installed, using raw text", file=sys.stderr)
else:
html_content = content
else:
print("Error: provide either an input file or --html", file=sys.stderr)
sys.exit(1)
# Wrap in basic HTML structure if not already a full document
if "
body {{ font-family: sans-serif; margin: 2cm; line-height: 1.5; }}
table {{ border-collapse: collapse; width: 100%; }}
th, td {{ border: 1px solid #ccc; padding: 8px; text-align: left; }}
th {{ background: #f5f5f5; }}
pre, code {{ background: #f5f5f5; padding: 2px 6px; border-radius: 3px; }}
{html_content}"""
HTML(string=html_content).write_pdf(args.output, stylesheets=stylesheets or None)
```
### Technical Analysis
The script accepts arbitrary HTML from either the `--html` argument or an input file and passes it directly to WeasyPrint. No custom URL fetcher, protocol allowlist, network restriction, or local-path validation is configured.
WeasyPrint can resolve externally referenced resources while rendering HTML, including images, stylesheets, a
...[truncated 2164 chars]
Remediation
View remediation
` elements.
6. **Add execution-level isolation.** Run rendering in a sandbox or container with minimal filesystem access, no credentials, resource limits, and no network connectivity when network access is unnecessary.
7. **Add regression tests.** Confirm that rendering rejects `file://` URLs and requests to loopback, private, link-local, and redirect-based destinations while continuing to support approved resources.
]]>
The declared description presents a broad PDF manipulation skill covering both input-side PDF processing and output-side PDF generation. However, the code chunk implements only PDF generation from HTML/Markdown sources. There is no functionality for opening or parsing PDFs, extracting text or tables, merging multiple PDFs, or interacting with PDF forms. While the generation portion matches part of the description, the overall declared purpose materially overstates the implemented capabilities, so this is a description-behavior mismatch.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The implemented code is a PDF reader/extractor utility. It supports metadata inspection, text extraction, table extraction, and page-range selection. Those behaviors align with part of the description ('read' and 'extract'). However, the declared description also claims broader capabilities—generating PDFs, merging PDFs, and filling forms—that are not present in this code chunk. This is a description-behavior mismatch because the declared purpose materially overstates the implemented functionality.
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares executable file-processing capabilities and references Python scripts that can read and write local files, but it does not define any explicit tool scope, permissions, or allowed-tools boundary. In an agent environment, this can lead to broader-than-intended file access because the skill advertises operations over arbitrary workspace paths without a clear least-privilege restriction.
