PDF阅读助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 2.0.0

Overview

This PDF helper appears purpose-aligned, but it should be reviewed because it can leave extracted document contents in a predictable temporary file while claiming cleanup occurs.

Install only if you are comfortable with local PDF contents being processed by these scripts. Avoid using the documented /tmp/pdf_extract.json workflow for sensitive documents; use a private temporary file or in-memory flow, delete outputs yourself, and install dependencies in a virtual environment with pinned versions where possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:12

Finding

Mandatory Verbatim Output Hijacks Agent Responses

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:169

Finding

Third-Party Dependencies Are Installed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:73

Finding

Predictable Shared Temporary File Can Expose Extracted PDF Content

Content

View full analysis

> /tmp/pdf_extract.json # Analyze it afterward /Users/kyle/.workbuddy/binaries/python/envs/default/bin/python3 \ ~/.workbuddy/skills/pdf-reader-assistant/scripts/analyze_pdf.py \ /tmp/pdf_extract.json ``` The documentation additionally claims that the temporary extraction result is automatically deleted after use. Neither reviewed script creates, secures, or removes this file. ### Technical Analysis The recommended workflow redirects the complete extraction result to the fixed path `/tmp/pdf_extract.json`. The generated JSON can contain full PDF text, OCR output, metadata, tables, and other potentially sensitive document information. A fixed filename in a shared temporary directory creates confidentiality and integrity risks in multi-user or concurrently running environments: - Existing content at the path is overwritten. - Concurrent jobs can read or replace one another's extraction results. - The shell creates the file according to the caller's current `umask`, rather than enforcing restrictive permissions. - Depending on operating-system temporary-directory protections and link-handling behavior, an attacker may attempt a symbolic-link or file-replacement attack. - The documentation promises automatic cleanup, but the implementation contains no cleanup logic, leaving extracted data behind after analysis. ### Attack Path A confidentiality attack can proceed as follows: 1. A user extracts a sensitive PDF using the documented command. 2. The complete extraction result is written to `/tmp/pdf_extract.json`. 3. The file remains present because no cleanup operation is implemented. 4. A ...[truncated 1301 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明与代码部分匹配：文本提取、表格提取、扫描版 OCR 基本都已实现。但代码的实际范围明显更窄，只是一个针对单个 PDF 的提取脚本，并未体现“智能问答”“多文档对比”“批量处理”等声明中的重要能力，因此描述对功能有实质性夸大。此外，代码还会枚举 PDF 中图片并返回图片数量与页面提示，这属于未在声明中明确列出的附加能力。整体上属于描述与实际行为不完全一致，且主要问题是过度声明核心功能。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill invokes local Python scripts against user-supplied PDF paths, which implies file-read capability, but it does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege controls and makes it easier for the skill to access local files beyond what users may reasonably expect when a PDF-related trigger fires.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are very broad and overlap with ordinary discussion of PDFs, reports, papers, and document analysis. Overbroad activation can cause the skill to engage unexpectedly and prompt file-handling behavior in contexts where the user did not clearly intend to invoke local document processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file instructs that on first activation the assistant 'must' output a fixed Chinese opening message verbatim. This imposes a language/locale choice on all users without opt-in or an alternative, which is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger scenario guidance is ambiguous and encourages activation from common natural-language requests like 'read this PDF' or 'analyze report,' without clear confirmation gates. In a skill that reads local files and may process folders in batch, ambiguous activation increases the chance of unintended access to sensitive documents.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

- 加密 PDF 需要密码才能读取，遇到时提示用户
- 扫描版自动检测逻辑：前5页文字量 < 50字/页时判定为扫描版
- 提取结果临时存储在 `/tmp/pdf_extract.json`，用后自动清理
- 中文扫描版识别需要 tesseract 安装 `chi_sim` 语言包：`sudo apt install tesseract-ocr-chi-sim`（Linux）或 `brew install tesseract-lang`（macOS）

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file description and OCR configuration indicate a Chinese-focused skill, and the OCR engines are explicitly invoked with Chinese language packs (chi_sim, ch_sim) plus English. Because the skill does not offer a language/locale choice or clearly justify that it is a region-specific tool, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring says it supports '图片描述', which implies describing image contents. In code, extract_image_descriptions merely enumerates embedded images per page and returns a canned note, with no vision model, OCR-on-images, or content analysis to justify that claim.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring for extract_image_descriptions says '提取PDF中图片并给出描述', suggesting descriptive analysis of images. The implementation only calls page.get_images(full=True) and returns page number, image count, and a generic advisory note, which contradicts the stated behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains natural-language documentation that assumes a Chinese-speaking user, but it does not provide an opt-in, alternative language, or justification for the locale restriction. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.