Security audit

Docling

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Docling helper, but it can make local network fetches for arbitrary URLs without clear destination safeguards.

Review before installing on shared agents, servers, CI runners, or machines with access to private networks. Use it only for trusted documents and URLs, avoid enabling remote services or external plugins unless vetted, and prefer pinning the docling version or running extraction in a sandbox with restricted network egress.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
Remediation: View remediation
'`. - Use a lock file or equivalent mechanism to constrain transitive dependency versions. - Verify package artifacts using cryptographic hashes or trusted signatures. - Explicitly configure a trusted package index and disable unintended fallback indexes. - Periodically review pinned dependencies for known vulnerabilities before updating them. - Perform installation and document processing as an unprivileged user in an isolated environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:29
Finding: Unrestricted URL Fetching Can Reach Internal Network Resources
Content: View full analysis
" --from html --to md ``` Output: creates a `.md` file in current directory (or use `--output`) ### Web Page → Plain Text ```bash docling "" --from html --to text --output /tmp/docling_out ``` ``` The workflow repeats the unrestricted invocation: ```markdown 1. **For web content extraction**: Use docling "" --from html --to text --output /tmp/docling_out ``` ### Technical Analysis The documented workflow passes a supplied URL directly to a network-capable CLI without requiring validation of the URL scheme, destination hostname, resolved IP address, redirect target, or port. If an untrusted party can influence the URL processed by the Agent, the fetch operation may be directed toward resources accessible from the Agent host but unavailable to the attacker. Potential destinations include loopback services, private-network hosts, link-local endpoints, and cloud instance metadata services. The generated output is subsequently read by the Agent, which can expose retrieved response content in the conversation. The warning about custom headers and remote services does not address destination validation. No evidence of automatic external exfiltration was found; exploitation requires the retrieved content to be returned or otherwise disclosed through the normal Agent workflow. ### Attack Path 1. An attacker submits a URL pointing to a loopback, private, link-local, or otherwise internal destination. 2. The Agent follows the Skill instructions and invokes Docling with the attacker-selected URL. 3. Docling sends the request from the Agent host, inheriting that host's network reachability. 4. The internal service responds, and Docling writes the extracted response into the output directory. 5. ...[truncated 908 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The CLI reference documents --enable-remote-services without warning that enabling it may send document contents or metadata to external systems. In a document-extraction skill that processes potentially sensitive PDFs, images, and web content, this omission can lead users to unknowingly exfiltrate confidential data over the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reference documents --allow-external-plugins without warning that third-party plugins execute untrusted code in the local environment. In this skill context, users may run docling on local machines or servers with access to sensitive files, so enabling plugins can create a path to arbitrary code execution, data theft, or system compromise.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.