T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:69- Finding
Mandatory Promotional Content Hijacks Delivery Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
PDF万能大师
Security checks for vulnerabilities and agentic risk
Overview
The skill is a mostly coherent PDF utility, but its high-risk redaction and protection workflows can give unsafe or misleading assurances about sensitive documents.
Review before installing for sensitive or regulated documents. Use redaction only on copies, manually inspect scanned/image pages, avoid sharing deletion certificates unless verified, provide a strong owner password for protected PDFs, and confirm where Feishu outputs, backups, logs, and certificates will be stored.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pdf_redact.py:48- Finding
Redaction Verification Certificate Stores Raw Residual Secrets in Plaintext
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pdf_redact.py:34- Finding
Text-Only Verification Can Falsely Certify Scanned Sensitive Content as Removed
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pdf_watermark.py:59- Finding
Predictable Timestamp-Derived PDF Owner Password Weakens Permission Controls
- Content
View full analysis
`. 3. An attacker obtains the protected PDF and estimates when it was generated from message timestamps, filesystem metadata, document metadata, or delivery records. 4. The attacker generates candidate passwords for a small window of nearby seconds. 5. The attacker tests those candidates with a PDF library or password-recovery utility. 6. After recovering the owner password, the ...[truncated 716 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (56)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向最终用户的全功能 PDF 处理技能，覆盖大量实际文档操作与智能分析能力。但代码片段本身只检查运行环境是否具备相关依赖：尝试导入 Python 模块、探测 tesseract/libreoffice 是否存在、列出 tesseract 语言包，并据此打印“能力就绪矩阵”。这属于辅助性的安装/部署检查，而不是所宣称的 PDF 智能处理行为。按照评估标准，这构成“主要目的 materially different primary purpose”的明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
该描述宣称的是一个覆盖几十项能力的综合 PDF 技能，但提供的代码块只对应其中“智能压缩”这一项扩展能力。代码没有实现转换、OCR、编辑、加密、水印、审查、签名、删除等任何其他核心功能，其实际主功能远比声明狭窄，属于描述与代码行为的重大不一致。虽然代码未表现出额外未声明的危险能力，但其主要用途与声明的‘全能 PDF 技能’明显不符。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
存在明显描述与代码行为不匹配。代码块的实际范围很窄：它是一个用于 PDF 转 .docx 或 .xlsx 的脚本，依赖 pdf2docx 和另一个表格提取脚本完成转换，附带页范围参数。相比之下，声明将该技能描述为一个多模块、全功能 PDF 平台，涵盖识别、编辑、安全、审查、归档、签名、删除等众多能力。虽然当前代码实现的 PDF→Word/Excel 可被视为声明中“Office 高保真互转”的一小部分，但整体描述严重超出此代码块实际行为，因此应判定为不准确匹配。未发现代码执行与声明无关的额外高风险或隐藏能力；问题主要是声明远超实现。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
按给定代码块看，其功能边界非常明确：使用 pdfplumber 提取 PDF 表格，借助 pandas 输出到 xlsx 或 csv，属于声明中“表格提取”这一单项能力的一个实现。它没有执行任何未声明的敏感或额外操作，因此不存在‘暗中越权能力’问题；但描述与实际行为在范围和主用途上存在显著不一致。声明把该技能表述为覆盖数十项 PDF 全流程能力的综合技能，而代码仅实现其中一小部分，且没有 OCR、编辑、加密、合并拆分、翻译、审查、签名、删除等能力，也没有飞书机器人相关触发实现。因此应判定为描述与实际代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
该描述与代码行为存在明显不匹配。声明将技能描述为功能极其全面的 PDF 智能处理平台，但此代码块只是一段单机命令行工具，核心用途是“检测 PDF 状态并清洗元数据”。它没有实现转换、OCR、编辑、加水印、压缩、翻译、合同审查、签名审批、表单、测量等绝大多数宣称能力。代码的主要行为是使用 PyMuPDF 打开文件、提取基本信息与 metadata、判断是否加密、粗略区分文本/扫描件、检测少数敏感词，并执行 metadata/xml/嵌入文件/隐藏内容/JS 的 scrub。虽然这可被视为声明中“元数据清洗”及少量“检测入口”的一个子能力，但远不足以支撑“全能 PDF 智能处理技能”的整体描述，因此应判定为描述严重夸大、与实际代码主功能不符。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
这是明显的描述与行为不匹配。代码的主要用途非常单一且明确：使用 PyMuPDF（fitz）批量合并多个 PDF，并根据文件名生成目录书签；还会跳过未提供密码的加密文件。它没有实现声明中绝大多数“全能 PDF 智能处理”功能，也没有任何 OCR、内容编辑、格式互转、权限设置、水印、压缩、翻译、合同审核、问答、签名审批流等逻辑。虽然“批量合并”属于声明能力集合中的一小部分，但声明将技能描述为一个覆盖众多场景的综合型平台，而实际代码只是其中一个狭窄子功能模块，因此从整体技能描述是否准确代表代码实际行为的角度，应判定为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个覆盖大量 PDF 生命周期能力的综合技能，但提供的代码块只对应“扫描件 OCR/生成可搜索 PDF/导出文本”这一小部分能力。虽然声明中包含 OCR，因此并非完全无关，但其主要目的与代码实际行为严重不匹配：代码没有实现转换、编辑、加密、水印、压缩、翻译、审查、归档、签名、替换、表单、测量、电子书、印刷导出或永久删除等功能，也没有飞书机器人相关逻辑。按标准，这属于描述显著夸大、主功能范围与实际代码不一致的情况，应判定为 mismatch。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
该描述与代码存在明显不匹配。代码文件 pdf_redact.py 的功能边界很清晰：它是一个面向 PDF 文本敏感信息删除的专用脚本，支持扫描预览、执行删除、双引擎残留验证以及删除证书输出。它并不实现声明中列举的大多数核心与扩展能力，也没有体现飞书机器人场景、文档问答、合同风险审查、OCR、格式转换等复杂功能。虽然声明中提到了“密文级永久删除”，这与代码功能相符，但这只是庞大声明中的一个子能力；从“技能声明是否准确代表代码实际行为”角度看，声明严重夸大了范围和主用途，因此应判定为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述将该技能定义为通用、全功能 PDF 处理平台，覆盖极广泛的文档处理能力；但提供的代码仅处理“水印 + 加密 + 权限控制”这一小部分功能。代码会读取输入 PDF、在各页按对角平铺方式插入动态水印文字，并在提供密码时以 AES-256 保存并限制打印/复制权限。这与声明中的部分子能力（加密、水印、权限控制）一致，但远不足以支撑其宣称的主要用途和大多数能力范围。未发现明显额外未声明的高风险能力；问题在于描述严重夸大，实际行为只实现其中很小一项。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是一个面向终端用户的全能 PDF 处理技能，覆盖大量具体文档处理与智能分析能力；但给出的代码片段只是 setup.sh 安装器，负责安装 Python 依赖和可选 OCR/Office/Paddle 组件，并执行环境自检。它最多体现了“为部分能力准备依赖”的支持性行为，而不是声明中的实际功能实现。根据评估标准，这属于主要目的 materially different：代码的主目的为环境部署，不是 PDF 智能处理本身，因此应判定为描述与行为不匹配。
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh fi # ---- 2. 系统包安装器探测 ---- SUDO=""; [ "$(id -u)" -ne 0 ] && command -v sudo >/dev/null 2>&1 && SUDO="sudo" sys_install() { # sys_install <apt包名> <brew包名> <yum包名> if command -v apt-get >/dev/null 2>&1; then $SUDO apt-get install -y "$1" elif command -v brew >/dev/null 2>&1; then brew install "$2"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description includes changing prices across 200 quotation documents, which is a large-scale write operation affecting user data. Although it mentions previewing differences, the README does not clearly warn users about the risk of unintended bulk edits, the need to verify scope, or whether originals are preserved before modification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The markdown describes permanently deleting quoted text and contact information from a document ("彻底删除，不是涂黑") but does not warn the user that this operation is irreversible and may permanently alter source files or sensitive records. For markdown files, destructive behaviors affecting user data should be accompanied by a clear warning about impact and recovery expectations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill declares execution paths that invoke local scripts, shell commands, and file processing, but it does not define any explicit tool scope or permission boundaries. In a document-processing skill, unrestricted file read/write and shell access increases the blast radius if routing logic, downstream scripts, or prompt-controlled operations are abused to access unintended files or run unintended commands.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The activation criteria are extremely broad and can trigger on common PDF-related phrases, causing the skill to engage in situations the user may not have explicitly intended. In a skill that can read, modify, redact, rename, and invoke scripts on files, over-triggering increases the chance of unintended processing of sensitive documents and accidental execution of higher-risk workflows.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger examples for the translation capability explicitly include only converting content into Chinese ("翻成中文") and the overall skill content is written as if Chinese is the default interaction language. There is no visible statement offering users a language choice or making locale behavior optional, which can violate language/locale policy requirements.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description advertises an extremely broad set of document-processing capabilities and trigger phrases without clearly constraining when the skill should activate or what operations require explicit user confirmation. In an agent environment, this can cause over-triggering, unsafe handling of sensitive documents, or accidental execution of destructive actions such as redaction, deletion, encryption, signing, or batch modification on the wrong files.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document title and all operational instructions are written exclusively in Chinese, which constitutes a language-specific requirement in the skill's natural-language guidance. There is no indication that users may choose another language or that the Chinese-only constraint is optional or justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The entire skill specification, required outputs, warnings, and user-facing confirmation language are written only in Chinese, with no indication that users may choose another language or locale. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This file mandates a single language for operating the skill content and user-facing delivery guidance, but it does not provide user opt-in, alternatives, or a documented region-specific justification. That creates a natural-language policy risk under the locale/language constraint rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The title and instruction indicate a Chinese command guide that should be shown when the user asks about capabilities, implying a fixed-language response behavior. There is no opt-in, alternative locale, or documented reason that the skill must respond only in Chinese.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide advertises electronic signature and approval-flow features but provides no warning that only authorized signers may use them, that signatures can have legal effect, or that identity/consent checks are required. In a document-processing skill used in chat workflows, this omission can normalize unauthorized signing or stamping requests and increase the risk of fraud, policy violations, or unenforceable records.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document is written entirely in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
该文档明确配置了读取消息、下载用户上传文件、上传结果文件以及创建/写入多维表格等能力，意味着用户内容会被传输到飞书接口并可能落入飞书消息、文件或表格存储中，但文档未要求进行用户告知、最小化写入或敏感数据提示。对该技能而言，处理对象经常是合同、发票、扫描件等高敏感文档，若缺乏透明披露和边界控制，容易造成隐私泄露、合规风险或将涉密内容意外写入群聊/多维表格。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document title and instructional text are entirely in Chinese, and the guidance is presented as the default operating mode without any opt-in or alternative language option. Under the language/locale policy rule, this is a natural-language policy concern unless the locale restriction is explicitly documented and justified as region-specific.
- Content
Static analysis
No suspicious patterns detected.