T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/weaver.py:660- Finding
Untrusted Markdown Can Trigger External Resource Requests During PDF Rendering
- Content
View full analysis
- Remediation
View remediation
Security audit
Doc Weaver
Security checks for vulnerabilities and agentic risk
Overview
This document-conversion skill is coherent overall, but its PDF workflow can let Markdown trigger external or local resource loading despite local-only privacy wording.
Install only if you are comfortable running local document-conversion scripts and managing pandoc, WeasyPrint, and python-docx yourself. Avoid converting untrusted Markdown to PDF unless you sandbox the process or disable network/local resource access, and prefer pinned dependency versions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:192- Finding
Third-Party Conversion Dependencies Are Installed Without Version or Integrity Constraints
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documentation clearly instructs users to run local Python scripts that read input files, write output files, and invoke external tooling such as pandoc/weasyprint, but the skill manifest does not declare any tool scope or permissions. This creates a governance gap: an agent or platform may execute file and shell-capable actions without explicit user-visible authorization boundaries, increasing the risk of unintended command execution, file overwrite, or misuse of local resources.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run(cmd): result = subprocess.run(cmd, cwd=ROOT, text=True, capture_output=True) if result.returncode != 0: print(result.stdout) print(result.stderr, file=sys.stderr)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python with open(css_path, 'w') as cf: cf.write(css_content) result = subprocess.run( [ "pandoc", md_path, "-o", str(output_path),
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest sets "language": "en", which indicates a fixed language/locale preference in natural-language metadata. There is no accompanying indication that users can opt into another language or that the English-only constraint is specifically justified as region- or compliance-bound.
- Content
Static analysis
No suspicious patterns detected.