Gugu Gaga

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:52 AM UTC
• Version: 0.1.1

Overview

The skill appears aligned with its stated document-analysis purpose, but its required setup installs mutable dependencies from a third-party package mirror, so it should be reviewed before use.

Install only in a dedicated virtual environment or container, preferably after replacing the mirror setup with pinned, hash-verified dependencies from a trusted source. Use local regulatory files, avoid enabling MarkItDown plugin or cloud options unless you intend that data flow, and review generated HTML before converting sensitive documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.py:11

Finding

Mandatory setup installs unpinned dependencies from a trusted third-party package mirror

Content

View full analysis

=20251230", "pdfplumber>=0.11.9"] ``` ### Technical Analysis The Skill documentation makes `python scripts/setup.py` a required first-installation step. This script invokes pip and permits it to resolve mutable versions of `playwright`, `python-pptx`, `Pillow`, build dependencies, and the dependencies declared by the bundled MarkItDown package. No lock file, exact dependency versions, artifact hashes, or `--require-hashes` enforcement is used. Package retrieval is redirected to a third-party mirror, and that host is explicitly marked as trusted. Consequently, the code installed and potentially executed during setup can differ from the code reviewed in this audit. Python packages may execute code during wheel installation, source builds, imports, or later runtime use. A compromised mirror, compromised upstream release, malicious replacement artifact, or unexpectedly resolved future package version could therefore introduce attacker-controlled code. This is a supply-chain exposure rather tha ...[truncated 1469 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (162)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s declared purpose is narrow and document-analysis focused, but the static findings indicate much broader and materially different behaviors, including remote fetching, plugin loading, external service use, subprocess execution, and unrelated rendering/export logic. This kind of capability mismatch is dangerous because users and reviewers may trust the declared description while the implementation performs undeclared operations on local or remote content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.