度慧文档转换-文档转PDF

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.0.5

Overview

The skill is a disclosed cloud document-to-PDF converter, but it can upload local documents to third-party storage under broad triggers without a strong consent boundary.

Install only if users understand that selected local documents will be uploaded to Duhui/Alibaba-controlled infrastructure in the cn-shanghai OSS flow. Use it for non-sensitive files or after explicit consent, prefer local conversion for confidential documents, provide AppCode through an environment variable or secret store rather than chat, and restrict network access to the documented endpoints where possible.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/duhui_doc_to_pdf.py:603

Finding

Local documents are uploaded to third-party storage without enforced prior consent

Content

View full analysis

str: content_type = mimetypes.guess_type(str(input_path))[0] or "application/octet-stream" status, body = send_oss_request( "PUT", object_key, stage="upload", body_path=input_path, content_type=content_type, ) if status < 200 or status >= 300: raise SkillError( "upload", f"OSS upload failed with status {status}: {body or 'empty response'}", ) object_url = build_object_url(object_key) parsed_url = urllib.parse.urlparse(object_url) if not parsed_url.scheme or not parsed_url.netloc: raise SkillError("upload", "OSS object URL is invalid") return object_url ``` ### Technical Analysis Uploading the source document is functionally necessary for the declared cloud conversion service. However, the implementation does not enforce an explicit consent boundary before transferring the file. It only writes a privacy message to standard error and then immediately performs the upload. This is particularly significant because `SKILL.md` broadly recommends triggering the Skill for generic document-to-PDF and format-conversion requests, rather than limiting activation to users who explicitly request Duhui or third-party cloud processing. The metadata states that notice is required before upload, but the script ...[truncated 1800 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/duhui_doc_to_pdf.py:493

Finding

Vendor-controlled PDF download URL is fetched without destination validation

Content

View full analysis

Path: output_path.parent.mkdir(parents=True, exist_ok=True) temp_path: Path | None = None try: with tempfile.NamedTemporaryFile( "wb", delete=False, dir=output_path.parent, prefix=f"{output_path.name}.", suffix=".part", ) as temp_file: temp_path = Path(temp_file.name) try: with urllib.request.urlopen( pdf_url, timeout=DOWNLOAD_TIMEOUT_SECONDS, context=VERIFIED_SSL_CONTEXT, ) as response: shutil.copyfileobj(response, temp_file) ``` ### Technical Analysis The `pdfurl` field originates from the remote query service and is treated as trusted solely because it is a non-empty string. The code does not validate: - The URL scheme. - The destination hostname. - Whether the resolved address is public. - Whether redirects remain on an approved host. - The response content type. - The downloaded file size. - Whether the content has a valid PDF signature. TLS certificate validation protects connections to HTTPS destinations, but it does not establish that the destination itself is authorized. If the vendor API is compromised, misconfigured, or malicious, it can return a URL targeting internal ser ...[truncated 2178 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'pdf_url' from os.environ.get (line 493, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/duhui_doc_to_pdf.py (reported line 534)May include surrounding context.

python

) as temp_file:
            temp_path = Path(temp_file.name)
            try:
                with urllib.request.urlopen(
                    pdf_url,
                    timeout=DOWNLOAD_TIMEOUT_SECONDS,
                    context=VERIFIED_SSL_CONTEXT,

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill requires environment access, local file writes, and outbound network access, but it does not declare an explicit tool/permission scope. That can cause an orchestrator or reviewer to underestimate what the skill can do, increasing the chance of unintended file exfiltration or execution in a broader-than-expected context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

技能名称及全文说明均固定为中文语境，且未提供语言选择、用户偏好继承或区域性约束说明。根据规则，若技能在自然语言层面强制特定语言而没有用户选择或明确理由，属于语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list includes broad generic phrases such as document conversion and PDF conversion, which can cause the skill to activate for unrelated requests. In this skill, accidental activation is riskier because execution uploads local files to third-party infrastructure and uses a secret-backed external API.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This skill explicitly transmits local user files to external vendor-controlled services and retrieves temporary upload credentials at runtime. Even though this is core functionality rather than covert exfiltration, it is still a real data-transfer risk because sensitive document contents leave the local environment and may temporarily persist remotely.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

- https://file.duhuitech.com/k/tmp_up.json
         - https://fmtmp.oss-cn-shanghai.aliyuncs.com
         - https://doc2pdf.market.alicloudapi.com/v2/convert_async
         - https://api.duhuitech.com/q
      data_handling:
         uploads_local_files_to_vendor_controlled_oss: true
         fetches_temporary_upload_credentials_at_runtime: true

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The documented workflow sends source documents to external endpoints, polls a vendor service, and downloads the resulting PDF from a vendor-provided URL. In context, this is expected behavior, but it remains sensitive because the skill handles arbitrary local documents and uses third-party infrastructure outside the user's trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

- `https://file.duhuitech.com/k/tmp_up.json`：运行时获取临时 OSS 上传凭证
- `https://fmtmp.oss-cn-shanghai.aliyuncs.com`：vendor 控制的临时 OSS 桶，用于上传本地源文件
- `https://doc2pdf.market.alicloudapi.com/v2/convert_async`：提交异步转换请求
- `https://api.duhuitech.com/q`：轮询转换状态
- vendor 返回的 `pdfurl`：下载输出 PDF

## Data Flow And Privacy

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The secret-handling guidance is internally inconsistent: it says the agent must not echo AppCode, but also suggests conditions under which it may be pasted in chat. That ambiguity can lead operators or users to disclose the AppCode through chat channels that may be logged, retained, or exposed to other components.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The 'When To Use' section repeats broad and overlapping task descriptions without strong gating conditions. That increases the chance that an agent invokes a networked file-upload skill when a local converter or a different workflow would be safer and more appropriate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly states that local files are uploaded to OSS and then sent to a third-party conversion service, but the document does not require explicit user warning, consent, or data-sensitivity checks before transmission. Because document conversion commonly involves confidential files, this creates a real data exfiltration and privacy risk rather than a merely informational issue.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/doc_to_pdf_ali.md (reported line 207)May include surrounding context.

URL

text

https://api.duhuitech.com/q?token=xxx

认证

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill transmits local documents to external services (file.duhuitech.com, Alibaba API, OSS, and result download URLs) as part of conversion. In this skill context that behavior is expected, but it remains security-relevant because sensitive local files leave the host, are stored remotely at least temporarily, and cleanup is only best-effort.

Content

Scanner excerpt · scripts/duhui_doc_to_pdf.py (reported line 37)May include surrounding context.

python

OSS_CREDENTIALS_URL = "https://file.duhuitech.com/k/tmp_up.json"

CONVERT_ASYNC_URL = "https://doc2pdf.market.alicloudapi.com/v2/convert_async"
QUERY_URL = "https://api.duhuitech.com/q"

POLL_INTERVAL_SECONDS = 2
POLL_TIMEOUT_SECONDS = 60 * 60

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill fetches OSS upload credentials from https://file.duhuitech.com/k/tmp_up.json at runtime, then uses them to upload the user's local document to third-party object storage. This introduces an additional secret-distribution channel outside the advertised Alibaba marketplace API flow and gives a remote endpoint control over where sensitive input documents are stored.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The file documents OCR recognition language choices such as English, Simplified Chinese, Traditional Chinese, Japanese, and Korean, but does not state that the language should be chosen based on user preference or input. This can create a locale-selection policy issue if the skill defaults or forces a language without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest frames the skill as converting a single local document to a PDF, which implies returning the converted local file. The code additionally returns the remote pdf_url and OSS source_object_key, disclosing remote storage details and artifacts beyond the core local conversion behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.