Outline Revision Annotator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:51 AM UTC
• Version: 1.1.0

Overview

This skill performs a disclosed local document-comparison workflow and does not show evidence of hidden access, exfiltration, persistence, or destructive behavior.

Install only in a dedicated virtual environment, pin dependencies if possible, and use this skill only on drafts you are comfortable duplicating into local plaintext, JSON, PDF, Markdown, and DOCX outputs. Review output paths before running the auto-follow workflow to avoid overwriting prior comparison files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/macos.md:8

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: references/macos.md:8
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

python3 -m pip install --upgrade pymupdf python-docx

The equivalent unsafe installation instruction also appears at references/windows.md:8:

powershell

python -m pip install --upgrade pymupdf python-docx

Technical Analysis

The documented workflows install the latest available versions of pymupdf and python-docx without exact version constraints, cryptographic hashes, a lock file, or an isolated virtual environment. The use of --upgrade additionally permits pip to replace versions already installed in the user's environment.

Dependency resolution therefore relies on mutable package-index state rather than a reproducible, reviewed dependency set. If a package release or distribution channel is compromised, installation hooks or imported package code could run with the privileges of the invoking Python process. A future incompatible release could also alter document parsing and rendering behavior or break the workflow.

No evidence was found that the named packages are currently malicious. The vulnerability is the unsafe and non-reproducible dependency installation practice.

Attack Path

1. A user or Agent follows the macOS or Windows setup instructions.
2. pip queries its configured package index and resolves the latest available package versions.
3. A compromised or otherwise unsafe release is selected because no approved version or hash is enforced.
4. Package installation logic executes during installation, or malicious package code executes when the helper script imports fitz or docx.
5. The malicious code operates with the filesystem, process, and network permissions of the invoking user.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's priv ...[truncated 415 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin dependencies to reviewed exact versions in a committed requirements file, for example:

   text

   PyMuPDF==<reviewed-version>
   python-docx==<reviewed-version>
   

2. Generate and verify cryptographic hashes, then install with:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Document creation and activation of a dedicated virtual environment before installation so the workflow does not modify the user's global or unrelated project environment.

4. Remove unconditional --upgrade from the setup commands.

5. Commit a lock file produced through a controlled dependency-review process and periodically scan locked packages for known vulnerabilities.

6. If supported operationally, install only from an approved package index or internal mirror and retain provenance information for reviewed artifacts.

7. Apply the same corrected installation guidance to both references/macos.md and references/windows.md.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly instructs the agent to read source files, generate reports, and write multiple output artifacts, but it does not declare an explicit tool scope such as allowed tools or permissions. That creates an authorization ambiguity: an agent platform may grant broader file access than intended, increasing the chance of overbroad reads/writes or unsafe composition with other skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The English trigger phrases include broad terms like 'compare new and old script versions' and 'create a high-signal change report' that could match ordinary editing or document-comparison requests outside the narrow PDF-annotation workflow. Accidental activation can cause the agent to read unrelated documents, auto-generate files, or invoke follow-on processing the user did not clearly request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Chinese trigger list contains very generic phrases such as '生成对比报告' and '生成标注版 PDF', which are likely to appear in many benign document workflows unrelated to this specialized skill. In combination with the auto-follow hook, this raises the risk of unintended execution, unnecessary file access, and surprise artifact generation on sensitive content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown instructs the user to verify that note boxes show Chinese correctly and adds troubleshooting for Chinese text rendering. This creates an implicit language/locale requirement in the workflow, but the file does not offer a user choice or explain why Chinese is required for this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The workflow directs the agent to automatically regenerate annotated comparison PDFs and reports after edits without requiring a fresh user confirmation before creating or overwriting output artifacts. In an agentic environment, implicit post-edit file generation can cause unintended file modifications, overwrite prior outputs, or create derived documents the user did not explicitly authorize at that moment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The instruction to verify that note boxes show Chinese correctly is a natural-language locale requirement. The file does not indicate that Chinese is optional, user-selected, or required for a documented region-specific purpose, so it appears to force a specific language context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The extract command reads the full contents of the input PDF and old source, then writes them into plaintext and JSON files in the output directory. While the script prints that files were written, it does not explicitly warn users that complete document contents and block text will be copied to disk, which can affect sensitive data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

When non-ASCII annotation text is present, the script requires a Chinese-capable font and raises an error explicitly referring to a Chinese-capable environment. This reflects a fixed locale assumption rather than offering the user a configurable font or broader language support option.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The render path writes multiple derivative files, including an annotated PDF, copied markdown, generated DOCX, and normalized manifest JSON. Although final print statements announce output paths, there is no prior warning in help text or comments that input report content and annotation metadata will be duplicated into new files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.