PDF Merge

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 1.0.1

Overview

This skill locally merges user-selected PDFs and does not show hidden behavior, exfiltration, persistence, or privilege escalation.

This appears safe to use for local PDF merging, but install it with normal package-supply-chain caution because pdf-lib is not pinned. Users who do not read Chinese may also find the documentation and command output harder to review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Third-Party PDF Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9-12
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

yaml

install:
  - kind: npm
    package: pdf-lib

Technical Analysis

The skill declares pdf-lib as an npm dependency without specifying an exact version. No integrity hash or dependency lockfile was present in the audited project. Consequently, separate installations may resolve to different package versions whose contents were not covered by this audit.

The application imports this dependency at index.js:9 using require('pdf-lib'). Node.js executes package initialization code during module loading. If the package source or a subsequently resolved release were compromised, attacker-controlled code could execute when the skill starts.

This finding is a supply-chain risk rather than evidence that the current pdf-lib package is malicious.

Attack Path

1. An attacker compromises the upstream package, publishing process, maintainer account, or package-distribution channel.
2. A user installs the skill after the compromised release becomes the version selected by npm.
3. Because the dependency declaration has no exact version or integrity constraint, installation resolves and installs the compromised package.
4. The skill loads the package through require('pdf-lib').
5. Malicious package initialization code executes with the same operating-system privileges and environment access as the Node.js process.

Impact Assessment

Successful exploitation could provide code execution under the account running or installing the skill. Depending on that account's permissions, an attacker could access readable local files and environment variables, alter writable files, tamper with generated PDFs, or perform network operations. The issue does not independently provide privilege escalation beyond the privileges already held by the affected Node.js process.

Remediation

View remediation

Remediation Suggestions

• Pin pdf-lib to a reviewed, exact version rather than allowing unconstrained resolution.
• Declare dependencies in package.json and commit an npm lockfile containing integrity hashes.
• Install reproducibly with npm ci and retain lockfile integrity verification in deployment workflows.
• Enable dependency vulnerability and provenance checks in CI.
• Review dependency updates before changing the pinned version.
• Run the skill with least privilege and limit its filesystem and network access where practical to reduce the impact of a dependency compromise.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code's natural-language description, usage text, status logs, and error messages are all written in Chinese, and there is no indication that the user can select another language or that the skill is intentionally limited to a Chinese-speaking context. That creates a language/locale policy concern under the rule for forced language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and main usage documentation are presented exclusively in Chinese. This can violate a language/locale policy when a skill forces a specific language without user opt-in and does not state that it is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.