Security audit

PDF: резюме для руководителя на одну страницу

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a disclosed local PDF summarization workflow, with no evidence of network exfiltration, credential access, persistence backdoors, or destructive behavior.

Install this only if you want a Russian-language one-page PDF summary workflow for PDFs. It stores a local job copy of the source PDF, extracted text/OCR data, fact records, and generated PDF/HTML/JSON outputs in the skill state directory, so treat that state as containing the document's sensitive content. Use it with PDFs you are comfortable processing locally, and request HTML only when you actually need it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Описание в целом частично соответствует тому, что внутри есть офлайн OCR без сети для PDF-страниц и сканов. Однако данный фрагмент кода фактически занимается низкоуровневым OCR и анализом расположения текста: распознаёт текст, определяет боксы, цвета, размер, угол, порядок чтения, объединяет фрагменты и поддерживает региональное извлечение. Это не реализация заявленного основного назначения — создания одностраничного executive summary PDF. Кроме того, описание утверждает, что сканы поддерживаются на латинице, тогда как код явно пытается подключить кириллическую OCR-модель (cyrillic_PP-OCRv5) из пакета или локального каталога и использует её при наличии. Наконец, в коде нет логики автоматической сверки каждого числа с текстом страницы. Поэтому имеется существенное расхождение между заявленным назначением и фактическим поведением этого фрагмента.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description presents the skill as an end-user summarization tool that creates a one-page PDF executive brief from PDFs, including offline OCR for scans and automatic number verification. This code chunk is only a supporting component: a fact registry that accepts manually/externally extracted facts, validates cited numbers against page text from existing job data, tracks page coverage, and manages stored facts. It relies on external metadata/text prepared elsewhere and merely references other tools like pdf.py and summary.py in guidance strings. There is no code here for reading PDFs, performing OCR, composing an executive summary, or generating a PDF. The automatic number cross-checking is consistent with the description, but the overall declared primary purpose is materially broader and different from what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a document-processing skill that ingests PDFs, performs OCR on scans, validates numeric facts, and produces a one-page executive PDF summary. The actual code chunk does none of these things. It only reads local reference material (summary_canon.md) and returns it, or lists available topics. While reading local files is consistent with the declared fs permission, the primary behavior is materially different from the declared purpose and lacks all core promised capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Описание заявляет конечный пользовательский результат — создание одностраничного executive summary PDF, включая аналитическое извлечение выводов и контроль чисел. Представленный код этого не делает: он является вспомогательным модулем приёма и предобработки PDF. Он читает PDF, сохраняет копию файла в state directory, извлекает и возвращает постраничный текст, определяет типы страниц, запускает локальный OCR и умеет рендерить страницы в PNG. Поддержка русских/английских PDF и офлайн OCR для сканов частично соответствует описанию, но основная заявленная функциональность резюмирования и проверки чисел отсутствует. Поэтому описание существенно не соответствует реальному поведению данного куска кода.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.
md
`SKILL.md`; `scripts/` — `pdf.py`, `facts.py`, `summary.py`, `guide.py`, модули `_core.py`, `_ocr.py`;

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The validation logic rejects untranslated English text and explicitly instructs users to translate content into Russian, while the rest of the skill also hardcodes Russian labels and typography rules. This is a language policy constraint imposed by the skill without presenting a language choice or documenting user opt-in.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description specifies a Russian one-page executive summary for both Russian and English PDFs, which indicates a fixed output language. This is a natural-language policy concern because no opt-in or alternative language choice is offered to the user, despite handling multilingual input.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The HTML document declares lang="ru", and the visible template text throughout the file is fixed in Russian. This imposes a specific language/locale on generated output without any user opt-in or documented justification, which matches the policy violation criteria for forced language selection.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Lines L004-L005 require the product to be produced 'на русском языке' in a fixed format. This is a natural-language locale restriction, and the file does not provide user opt-in or explain that the skill is limited to a Russia-specific or otherwise justified regional context.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring states that the skill validates numbers against Russian text and applies Russian typography, indicating a fixed language/locale behavior. There is no visible natural-language indication here that users can choose another language or opt into this locale constraint.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module docstring, command descriptions, validation messages, and user-facing output strings are entirely in Russian, which imposes a specific language on users. The file does not offer any language selection or explain that the skill is intentionally limited to a Russian-only locale or region-specific workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring and command descriptions are entirely in Russian, and the script's user-facing outputs later also use Russian-only text. This imposes a specific language on users without offering a language choice or explaining that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script replaces output files and deletes legacy/draft artifacts automatically without user confirmation. In a filesystem-enabled skill, this can cause unintended data loss or destroy prior outputs that may be needed for audit, rollback, or comparison, especially if invoked on the wrong job or with malformed paths from shared helpers.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code always calls render_html(...) during build, even though the skill description says HTML should be produced only on request. This can create an unexpected additional artifact that may expose the same sensitive summary content in a more easily parsed and redistributed format than the intended PDF-only deliverable.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The response embeds operational instructions telling the agent to copy outputs into a user-accessible Deliverables directory and send files via platform tooling. This expands the skill from local document generation into file delivery/orchestration behavior, increasing the chance of unintended disclosure or policy bypass if the agent follows these instructions automatically.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The docstring frames build as a deterministic local assembly pipeline focused on validation, typography, and rendering. In practice, cmd_build also returns procedural instructions for an agent to copy files to a user folder and use send_file, which is not part of the described deterministic build operation. This creates an intent/documentation divergence about what the command encompasses.
Content: No source excerpt is available for this finding.