web page to pdf

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:05 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, converting user-provided web pages to PDFs, but it should be used only with trusted URLs and a controlled output folder.

Install this only if you are comfortable running a local browser-based converter. Use it with URLs you intentionally choose, avoid converting local/private-network addresses unless that is your goal, and provide simple filenames in a dedicated working directory to prevent accidental overwrites. For stronger security, pin Playwright versions and run the converter in a restricted environment.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/pdf2.py:24
• Finding: Unrestricted URL Navigation Enables Server-Side Request Forgery<![CDATA[ ## Vulnerability Details **File Location**: `scripts/pdf2.py`, lines 24–26 and 44–47 **Vulnerability Type**: Server-Side Request Forgery (SSRF) **Risk Level**: High ### Vulnerable Code ```python # Validate URL if not url.startswith(('http://', 'https://')): url = 'https://' + url ``` ```python browser = p.chromium.launch() page = browser.new_page() page.goto(url, wait_until='load', timeout=60000) ``` ### Technical Analysis The script accepts a user-controlled URL and passes it to Playwright without validating the destination hostname or resolved IP address. The check only ensures that the input begins with `http://` or `https://`, adding HTTPS otherwise. This does not prevent Chromium from connecting to loopback addresses, private network ranges, link-local addresses, cloud metadata services, or internal DNS names. Redirect targets are not validated either, so an initially public URL could redirect the browser to a protected internal resource. Because the resulting page is rendered into a PDF, content obtained from an internal endpoint may be returned to the requesting user through the generated document. ### Attack Path 1. An attacker supplies an address reachable from the host but not directly accessible to the attacker, such as `http://127.0.0.1:<port>`, an internal hostname, or a private-network address. 2. Alternatively, the attacker supplies a public URL that redirects to an internal destination. 3. The script accepts the URL because it uses an allowed scheme. 4. Playwright connects to the destination using the host's network access. 5. The internal response is rendered and written to the output PDF. 6. The attacker obtains the PDF and inspects information exposed by the internal service. ### Impact Assessment An attacker may access HTTP services reachable from the execution environment, including local administration interfaces, private intranet applications, development services, and potentially cloud instance metadata endpoints. ...[truncated 217 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Permit only explicitly required schemes, preferably HTTPS. - Parse the URL and reject embedded credentials, malformed hostnames, and unsupported ports. - Resolve the hostname before navigation and reject all loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 addresses. - Revalidate the resolved address immediately before use to reduce DNS rebinding risk. - Validate every redirect destination using the same rules, or disable automatic redirects and process them manually. - Prefer an explicit domain allowlist when the intended use permits it. - Run Chromium in an isolated environment with outbound firewall rules that deny access to local, private, and metadata networks. - Apply request duration and response-size limits to reduce secondary denial-of-service risk. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pdf2.py:35
• Finding: User-Controlled Output Path Permits Arbitrary PDF File Creation or Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/pdf2.py`, lines 35–37 and 50–51 **Vulnerability Type**: Path Traversal and Unrestricted File Write **Risk Level**: Medium ### Vulnerable Code ```python # Ensure .pdf extension if not output.endswith('.pdf'): output += '.pdf' ``` ```python page.pdf( path=output, ``` ### Technical Analysis The optional output argument is used directly as a filesystem path. Checking or appending the `.pdf` suffix does not constrain where the file is written. Absolute paths and paths containing parent-directory components such as `../` remain valid. Consequently, a caller can direct Playwright to create or replace a PDF anywhere writable by the process. Existing files with a `.pdf` suffix may be overwritten, and symlinked paths could redirect the write to another filesystem location. ### Attack Path 1. An attacker invokes the skill with a crafted output argument such as `../../shared/target.pdf` or `/writable/absolute/path/report.pdf`. 2. The extension check accepts the path because it ends in `.pdf`, or appends that extension without removing traversal components. 3. The path is passed directly to `page.pdf`. 4. Playwright creates or replaces the selected file using the process's filesystem privileges. 5. The attacker causes unauthorized file placement or destruction of an existing writable PDF. ### Impact Assessment The attacker can create or overwrite files ending in `.pdf` outside the intended working directory wherever the process has write permission. This can cause data loss, tamper with shared documents, consume storage, or place attacker-selected PDF content in sensitive or trusted locations. The issue does not directly grant permissions beyond those already held by the process. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Store generated documents in a dedicated output directory controlled by the application. - Treat user input as a filename rather than a path and reject absolute paths, directory separators, `.` components, and `..` components. - Resolve the final destination with `Path.resolve()` and verify that it remains beneath the approved output directory. - Generate server-side filenames where possible and map user-visible names separately. - Refuse to overwrite existing files by default, using exclusive creation or randomized unique names. - Reject symlinks and verify parent directories before writing. - Run the converter under a dedicated low-privilege account with access only to the required output directory. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:31
• Finding: Unpinned Playwright and Browser Installation Creates Supply-Chain Exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31–32 **Vulnerability Type**: Unpinned Third-Party Dependency Installation **Risk Level**: Low ### Vulnerable Code ```bash pip install playwright playwright install chromium ``` ### Technical Analysis The setup instructions install the latest available Playwright package without a version constraint or package hash. The subsequent command downloads a Chromium build selected by that mutable Playwright version. As a result, installations performed at different times may execute different package code and use different browser artifacts from those originally reviewed. The project does not provide a lock file, integrity hashes, or a controlled artifact source in the audited files. ### Attack Path 1. An operator follows the documented setup instructions. 2. `pip` resolves the current Playwright release rather than a specifically reviewed version. 3. The Playwright installer retrieves its corresponding Chromium artifact. 4. If an upstream release, package-distribution account, index resolution path, or downloaded artifact is compromised, malicious or unexpectedly changed code enters the environment. 5. That code executes with the privileges of the user performing installation or running the converter. ### Impact Assessment A compromised dependency or browser artifact could execute arbitrary code with the installer or converter process's privileges, potentially exposing files, credentials, and network resources available to that account. No evidence of an actually malicious dependency was found; this finding concerns the lack of reproducibility and integrity controls. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin Playwright to a specifically reviewed version. - Maintain dependencies in a lock file or requirements file with cryptographic hashes. - Use a controlled package index or trusted internal mirror. - Verify the integrity and provenance of downloaded Chromium artifacts. - Build and publish a pre-reviewed container image so runtime environments do not download mutable dependencies. - Automate dependency vulnerability scanning and update pinned versions through a reviewed process. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.