opendataloader-pdf

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:16 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward PDF parsing helper with disclosed package installation steps and no hidden persistence or data exfiltration behavior in the inspected artifact.

Install only packages you trust, preferably with pinned versions or a locked environment, and process sensitive or untrusted PDFs in a least-privileged workspace. The artifact does not show hidden behavior, but PDF parsers and optional OCR/hybrid dependencies expand the code and file-processing surface.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21–28 and line 85
Vulnerability Type: Unpinned dependencies installed from external package registries
Risk Level: Medium

Vulnerable Code

bash

# Python
pip install -U opendataloader-pdf

# Python with hybrid AI mode (for complex documents)
pip install -U "opendataloader-pdf[hybrid]"

# Node.js
npm install @opendataloader/pdf

bash

pip install langchain-opendataloader-pdf

Technical Analysis

The Skill instructs users or Agents to install third-party Python and Node.js packages without pinning reviewed versions. The Python commands additionally use -U, which directs pip to select the newest compatible release at installation time.

No lockfile, version constraint, package hash, registry restriction, signature-verification procedure, or reproducible dependency manifest is provided. Consequently, the code installed later may differ from the code that was available when the Skill was reviewed. Optional extras such as hybrid also increase the unresolved transitive dependency surface.

This creates a software supply-chain exposure: compromise of a package publisher, registry account, package release, or transitive dependency could cause attacker-controlled installation or runtime code to execute. The repository attribution alone does not establish that downloaded registry artifacts are identical to reviewed source code.

Attack Path

1. An attacker compromises a listed package, its publisher account, or one of its transitive dependencies.
2. The attacker publishes a malicious release that remains compatible with the unrestricted installation command.
3. A user or Agent follows SKILL.md and executes the documented pip install -U, pip install, or npm install command.
4. The package manager resolves and downloads the attacker-controlled release.
5. Malicious package installation hooks or imported runtime code execute in the installation environment.
6. The pay ...[truncated 795 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an explicitly reviewed version rather than resolving the latest release.
2. Remove -U from documented installation commands unless an intentional, separately reviewed upgrade is being performed.
3. For Python, publish a lock or constraints file with hashes and install using hash enforcement, such as pip install --require-hashes.
4. For Node.js, commit a reviewed lockfile and use deterministic installation such as npm ci.
5. Configure trusted official registries explicitly and prevent unapproved fallback registries or dependency-confusion sources.
6. Verify package provenance through registry signatures, attestations, checksums, or reproducible builds where available.
7. Audit and pin transitive dependencies, particularly those introduced by the hybrid extra and the LangChain integration.
8. Perform dependency installation inside a least-privileged, isolated environment without production credentials or unnecessary host access.
9. Establish a controlled update process that reviews release changes and regenerates locks and hashes before adopting new versions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description is broad enough to trigger on many PDF-related tasks without clearly constraining when the skill should or should not be used. In an agent setting, overly broad invocation criteria can cause unnecessary or inappropriate activation on untrusted documents, increasing exposure to risky parsing workflows and reducing the chance that safer or more specialized handling is chosen.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.