Merge Reimbursement PDFs

• Outcome: Review
• Latest audit: May 28, 2026 · 11:28 AM UTC
• Version: 1.0.2

Overview

The skill mostly matches its PDF-merging purpose, but it can automatically install Python packages and LibreOffice through system package managers unless disabled.

Review before installing. Use this only in an environment where it is acceptable for a document tool to install Python packages and possibly LibreOffice, or run it with --no-auto-install after manually installing trusted, pinned dependencies. Avoid pointing it at broad folders; use a dedicated reimbursement folder and review the generated report and thumbnails.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("LibreOffice/soffice not found. Attempting automatic install...", file=sys.stderr)
    for command in commands:
        result = subprocess.run(command, check=False)
        if result.returncode != 0:
            raise RuntimeError(f"automatic LibreOffice install failed while running: {' '.join(command)}")

• Confidence: 97% confidence
• Finding: The script automatically runs system package-manager commands such as apt, dnf, yum, winget, or choco when LibreOffice is missing. This crosses from document processing into privileged system modification and can trigger unintended software installation, repository trust issues, or execution of package-manager operations without explicit user confirmation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not AUTO_INSTALL_DEPS:
            raise
        print(f"Installing missing Python package: {package_name}", file=sys.stderr)
        subprocess.check_call([sys.executable, "-m", "pip", "install", package_name])
        return importlib.import_module(module_name)

• Confidence: 98% confidence
• Finding: The script automatically invokes pip to install missing Python packages at runtime. Installing code from package indexes during execution expands the trust boundary, can introduce supply-chain risk, and performs networked code acquisition not implied by a simple PDF-merging skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises executable behavior involving shell access, environment access, and file writes but declares no permissions. That creates a trust and review gap: users or platforms may treat it as lower-risk than it is, while it can still modify files and invoke external commands. In this context, the risk is increased because the documented workflow includes package installation and document generation, both of which can materially change the host system and filesystem.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior exceeds the stated core purpose by including automatic pip installs, system package manager installs, report generation, thumbnail rendering, and multi-output folder processing. This mismatch is dangerous because users may consent to a simple local PDF merge while the skill also performs networked dependency installation and broader system changes, expanding the attack surface significantly. The skill context makes this more dangerous because package-manager execution is far more sensitive than ordinary document processing.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Automatic installation of LibreOffice via brew, winget, choco, apt-get, dnf, or yum allows the skill to alter the host system beyond the expected scope of merging reimbursement PDFs. Running package managers can introduce supply-chain risk, require elevated privileges, change system state, and execute additional install scripts, which is disproportionate for a document-processing skill. The context increases severity because this occurs as a convenience feature rather than a clearly separated administrative setup step.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill description suggests document merging, but the code also installs Python packages automatically and later can install LibreOffice. This hidden expansion of capabilities is security-relevant because it performs software installation and external dependency acquisition beyond the user's likely expectations for a local merge utility.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code explicitly invokes OS package managers to install LibreOffice, which may modify the host system and often requires elevated privileges. In the context of a document-processing skill, that behavior is dangerous because it can unexpectedly change system state and execute package-manager transactions without a separate installation workflow.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code installs missing Python packages via pip during normal execution, introducing remote dependency retrieval and code installation at runtime. In a skill meant to merge reimbursement files, that behavior meaningfully increases risk because it extends trust to package repositories and executes newly fetched code on the user's machine.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Automatic installation of Python packages and potentially LibreOffice occurs by default unless the user disables it, and the script provides no meaningful upfront consent gate. That makes the behavior risky from a software-safety perspective because users invoking a file-merging tool may not realize it can perform network installs and system changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

PyMuPDF>=1.23
Pillow>=10
openpyxl>=3.1

• Confidence: 93% confidence
• Finding: PyMuPDF is specified with a lower bound only, which allows future installs to pull different versions over time and makes builds non-reproducible. In a document-processing skill, this increases supply-chain risk and can unexpectedly introduce vulnerable or breaking releases into an environment that handles untrusted PDFs.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

PyMuPDF>=1.23
Pillow>=10
openpyxl>=3.1

• Confidence: 96% confidence
• Finding: Pillow is also unpinned, so installations may resolve to different versions depending on time and environment. Because this skill processes user-supplied images and screenshots, dependency drift is more dangerous here: a newly introduced vulnerable image parser could expose the host to denial-of-service or code-execution risks.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

PyMuPDF>=1.23
Pillow>=10
openpyxl>=3.1

• Confidence: 91% confidence
• Finding: openpyxl is declared with only a minimum version, which leaves the exact installed package version uncontrolled. Since the skill converts Excel workbooks, untrusted spreadsheet parsing occurs in practice, so reproducibility and prompt patch management matter for preventing parser-related issues from entering through transitive or future releases.

Known Vulnerable Dependency: PyMuPDF — 1 advisory(ies): CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)

Low

• Category: Supply Chain
• Confidence: 71% confidence
• Finding: The dependency spec permits PyMuPDF versions that may include a reported path traversal issue, and this skill handles filesystem content recursively, which makes any file-path weakness more relevant. Even if the exact advisory details may depend on CLI usage, leaving the version unconstrained means a vulnerable release could be installed in an automation context that touches many files.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: Pillow has a substantial history of serious parsing flaws, including code execution and resource-consumption issues, and this skill explicitly processes untrusted images such as phone screenshots and invoices. That context makes the dependency particularly dangerous because attacker-controlled image files are a primary input, so exploitation could lead to host compromise or denial of service during conversion and merging.

Known Vulnerable Dependency: openpyxl — 2 advisory(ies): CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: openpyxl has known XML entity handling issues, and this skill converts Excel workbooks as part of normal operation. Because spreadsheet files may come from reimbursement folders and could be attacker-supplied, vulnerable workbook parsing can enable XXE-style attacks, data disclosure, SSRF-like effects, or denial of service depending on parser behavior and environment.

Static analysis

No suspicious patterns detected.