PDF万能大师

• Outcome: Pass
• Latest audit: Jul 26, 2026 · 2:13 PM UTC
• Version: 2.1.0

Overview

The skill is a broad PDF-processing tool that handles sensitive documents, but its inspected behavior is disclosed, purpose-aligned, and guarded by confirmation steps for high-risk actions.

Before installing, be comfortable with local PDF processing, package installation from PyPI/system package managers, and optional external services for Feishu, invoice verification, translation, and signing. Use local-only handling for confidential files, require previews before edits/redaction/bulk replacement/signing, and keep PDF/OCR dependencies updated.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to run local scripts, read uploaded PDFs, write output files, and invoke shell commands like `bash setup.sh`, but it declares no permissions or trust boundaries. That mismatch is dangerous because users and hosting platforms cannot accurately reason about what filesystem and command execution capabilities the skill requires, increasing the risk of unexpected code execution or file access.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: This is a genuine integrity issue because the file explicitly requires all numeric claims to match actual processing data, yet this canned message hard-codes '5 分钟完成初筛' instead of deriving the value from the current task. In a contract-review context, fixed performance claims can mislead users about review depth, speed, or reliability and may create compliance, trust, or misrepresentation risk.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README advertises processing of invoices, contracts, redaction, and external verification workflows, but it does not clearly disclose whether documents may be sent to third-party services, what data leaves the local environment, or what privacy/compliance implications apply. In a PDF-processing skill, users may upload highly sensitive files, so missing data-handling warnings can lead to unintended exposure of personal, financial, or confidential business information.

Vague Triggers

High

• Confidence: 82% confidence
• Finding: The trigger conditions are extremely broad, covering many generic phrases such as '处理一下这个文件', summaries, Q&A, review, translation, renaming, and deletion-related requests. Overbroad triggering can cause the skill to activate on loosely related document conversations and then begin file inspection or script-driven processing that the user did not clearly intend.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The manifest description advertises a very broad set of PDF-related actions and trigger phrases without meaningful boundary conditions, approval gates, or task-scoping constraints. In an agent setting, this can cause over-activation or misuse on sensitive documents, especially for destructive or high-risk functions such as permanent deletion, redaction, signature workflows, contract review, and bulk replacement.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide advertises collecting PDF form submission data into tables, links, or QR-code workflows without warning users that personal or sensitive data may be stored, shared, or retained in downstream systems. In a document-processing skill, users may upload contracts, HR forms, invoices, or identity-bearing documents, so silent data collection increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill guide offers approval-flow setup and signature invitations but does not warn that this may trigger outbound notifications, share documents with third parties, or expose signer identities and document metadata. Because this skill handles sensitive PDFs such as contracts and invoices, unexpected sharing or notification actions could leak confidential business information or create unintended legal/process consequences.

Known Vulnerable Dependency: Pillow==10.0 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`) +7 more

Critical

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: The dependency specification allows installation of Pillow 10.0, and the supplied advisory context indicates this version is affected by multiple known vulnerabilities, including severe memory-safety and potential code-execution issues. In this skill, Pillow is used for image recompression and watermarking on user-supplied PDF/image content, which increases exposure because attackers can provide malformed files that trigger vulnerable parsing paths.

Known Vulnerable Dependency: pypdf==4.0 — 10 advisory(ies): CVE-2026-48156 (pypdf: Possible long runtimes for zero-only width values in cross-reference stre); CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks); CVE-2026-27628 (pypdf has a possible infinite loop when loading circular /Prev entries in cross-) +7 more

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The manifest permits pypdf 4.0, and the static finding indicates multiple parser DoS-style issues such as infinite loops and excessive runtime on malformed PDFs. In the context of a PDF-processing skill that is explicitly triggered by user-uploaded documents, this is more dangerous because an attacker can supply crafted PDFs to hang the worker, exhaust CPU, or disrupt availability.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.