Pdf Cn

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:10 PM UTC
• Version: 1.0.1

Overview

This is a coherent PDF-processing skill, with some ordinary local-file and dependency cautions but no hidden execution, persistence, or data exfiltration found.

Install dependencies from trusted package indexes, prefer pinned versions, quote file paths carefully, and make backups before running any command that modifies PDFs in place such as qpdf --replace-input.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:238

Finding

Unpinned Third-Party Package Installation Instruction

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:238
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Low

python

# Requires: pip install pytesseract pdf2image

Technical Analysis

The documentation instructs users to install pytesseract and pdf2image without specifying reviewed versions or cryptographic hashes. Consequently, dependency resolution is not reproducible and may retrieve newer, incompatible, vulnerable, or compromised releases from the configured Python package index.

This risk is compounded by _meta.json declaring an empty dependency list even though the scripts rely on external packages such as pypdf, pdf2image, Pillow, and pdfplumber. There is therefore no authoritative, version-controlled dependency manifest for validating the packages required by the Skill.

No evidence was found that the named packages or this project are currently malicious. The issue is the unsafe and non-reproducible dependency installation practice.

Attack Path

1. A user follows the OCR prerequisite in SKILL.md.
2. The user runs pip install pytesseract pdf2image without version or hash restrictions.
3. pip resolves packages and transitive dependencies from the user's configured package index.
4. If an upstream package, release, index, or dependency is compromised, malicious installation or runtime code is downloaded.
5. That code executes with the privileges and filesystem access of the user running pip or the PDF workflow.

Impact Assessment

Exploitation depends on compromise or unsafe substitution within the dependency supply chain. A malicious package could execute arbitrary code with the invoking user's privileges, access files available to that user, modify the Python environment, or affect PDFs and other data processed by the Skill. The Skill itself does not request elevated privileges, so the direct privilege scope is normally limited to the account perfor ...[truncated 22 chars]

Remediation

View remediation

Remediation Suggestions

1. Add an authoritative dependency manifest containing every required runtime package.
2. Pin each dependency and relevant transitive dependency to a reviewed version.
3. Generate and commit a lock file with cryptographic hashes, using tooling such as pip-tools.
4. Require hash verification during installation, for example with pip install --require-hashes -r requirements.txt.
5. Document the expected official package index and warn against untrusted mirrors or additional indexes.
6. Keep _meta.json synchronized with the actual dependencies imported by the scripts.
7. Periodically scan pinned dependencies for known vulnerabilities and update them through a controlled review process.
8. Replace the unpinned inline installation command with a reference to the reviewed, hash-locked dependency file.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a general PDF processing capability focused on reading, extracting, merging, splitting PDFs, and handling text, tables, and annotations. The supplied code does not process PDF files at all. It loads a JSON structure containing form field bounding boxes, checks rectangle intersections and text-fit constraints, and reports validation errors. This is a materially different primary purpose from the declared PDF document processing functionality, so the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description centers on PDF document processing tasks such as reading, extraction, merging, splitting, text extraction, table recognition, and annotations on PDFs. The supplied code does not operate on PDFs directly. Instead, it reads field metadata from JSON, opens an image via PIL, draws bounding boxes, and saves an annotated image for validation. This is a materially different primary purpose: image-based visualization of form field regions, not general PDF processing as described.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Using extremely broad trigger phrases like PDF and pdf can cause the skill to activate during ordinary conversation or unrelated tasks, increasing the chance that file-processing instructions or code paths are invoked unintentionally. In a skill that discusses reading, writing, decrypting, and transforming documents, accidental activation can expose users to unnecessary data handling or unsafe operations on sensitive files.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest frames the skill as a PDF processing guide centered on reading, extracting, merging, splitting, text extraction, table recognition, and annotations. However, the documented behavior substantially expands beyond that scope into PDF creation, OCR, password protection, decryption, watermarking, image extraction, and form workflows, which are not disclosed in the manifest description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation instructs users to run ImageMagick shell commands with user-supplied file paths and crop parameters. In an agent setting, this can become dangerous if filenames, directories, or coordinates are derived from untrusted input and passed through a shell, creating command-injection risk or unsafe invocation of powerful external tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example uses qpdf --replace-input corrupted.pdf, which overwrites the original file in place after modification. In a reference skill, users may copy commands directly; without a clear warning or safer backup-first pattern, this can cause irreversible data loss if the repair fails, produces unexpected output, or is run on the wrong file.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description says the skill 'processes PDF documents' and supports multiple actions, but it does not define specific trigger phrases, activation boundaries, or exclusions. In a manifest file, this broad natural-language description can make it unclear when the skill should activate versus when a general document-related request should be handled by something else.

Content

No source excerpt is available for this finding.