PDF: резюме для руководителя на одну страницу

• Outcome: Pass
• Latest audit: Sep 22, 2026 · 11:39 AM UTC
• Version: 1.3.3

Overview

This skill is a coherent local PDF summarizer that stores document-processing state and outputs a Russian executive-summary PDF.

Before installing, be comfortable with the skill keeping local processing artifacts for each PDF in its state directory, including extracted text and an HTML copy of the summary. Use it for Russian executive summaries and avoid sending the HTML output unless you specifically need it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: Описание заявляет конечный пользовательский навык: создание A4 PDF-резюме из текстовых и сканированных PDF с OCR и проверкой чисел. Представленный код — это внутренний компонент памяти/реестра фактов, который принимает уже извлечённые факты, проверяет числовые значения по текстовому контексту страницы и сохраняет их в facts.json. Это соответствует лишь узкой части описания про автоматическую сверку чисел. Основная заявленная функциональность — чтение PDF, OCR сканов, формирование одностраничного PDF-отчёта для руководителя — в этом фрагменте отсутствует. Дополнительно код выполняет недекларированное управление реестром фактов и покрытием страниц. Поэтому описание и поведение данного куска кода существенно расходятся.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description promises a document-analysis/report-generation skill with PDF handling, OCR, and validation logic. The supplied code chunk does none of that. It only accepts a topic argument, reads a corresponding markdown file from a local references directory, and returns its text. This is a materially different primary purpose, not merely a supporting implementation detail. The filesystem access is consistent with declared fs permission, but the behavior itself does not match the declared skill functionality.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Заявленное назначение — конечный пользовательский навык по созданию executive summary в PDF. Представленный фрагмент реализует лишь низкоуровневую обработку входного PDF: проверку файла, копирование в рабочую директорию, извлечение текста по страницам, эвристическую классификацию страниц (text/mixed/scan/scan_text/broken), локальный OCR, просмотр текста страниц и рендер страниц в PNG. Это соответствует подсистеме подготовки/чтения PDF, а не созданию итогового одностраничного резюме. Ключевые обещания описания — A4 PDF-отчёт, ключевые выводы, вопросы для обсуждения и автоматическая сверка каждого числа — в данном коде отсутствуют. Поэтому описание существенно не соответствует реальному поведению куска кода.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: Основная часть описания про одностраничное резюме A4 и автоматическую проверку чисел в целом соответствует: код действительно собирает one-page PDF, контролирует переполнение, проверяет числа и делает черновик/готовый вердикт. Однако есть существенные расхождения в заявленных возможностях. Во-первых, в коде отсутствует обработка исходных PDF и OCR: он не читает PDF напрямую, а использует уже подготовленные артефакты состояния задания (meta.json, facts.json, page_text_for_numbers через core), причём предупреждает о непрочитанных страницах и ссылается на внешние шаги вроде pdf.py pages / facts.py skip. Во-вторых, обещание 'каждое число сверяется с текстом страницы автоматически' не полностью соблюдается: точная постраничная проверка выполняется только если переданы source_pages; иначе для некоторых полей делается лишь сверка со всем документом и выдаётся warning. Дополнительно код генерирует HTML-выход и содержит логику доставки файлов, чего в описании нет. Поэтому описание заметно переобещает ключевые возможности извлечения/OCR и точности сверки.

Ae1

High

• Category: analysis-evasion

Content

`SKILL.md`; `scripts/` — `pdf.py`, `facts.py`, `summary.py`, `guide.py`, модули `_core.py`, `_ocr.py`;

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The description states the skill produces a one-page executive summary and specifically frames handling around Russian and English PDFs, while the overall skill title and instructions are written as a Russian-language output workflow. There is no explicit opt-in or user choice for output language, which can violate a language/locale policy when the skill implicitly defaults to Russian.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The HTML tag sets `lang="ru"`, and the surrounding visible text is also fixed in Russian, which indicates the skill enforces a specific locale. Under the policy, locale constraints should either be user-selectable or clearly documented as justified for a region-specific use case.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file explicitly requires the product to be produced "на русском языке" and later reinforces "Чистый русский," making the language fixed rather than user-selectable. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified as region-specific, which is not stated here.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code's natural-language interface is entirely in Russian, including the module description and later user-facing failures and hints, but the file does not indicate that Russian is optional or that the skill is explicitly region- or locale-scoped. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The module docstring and surrounding comments are written exclusively in Russian, including operational notes and warnings. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless a locale restriction is explicitly justified, which is not present here.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code file contains natural-language instructions entirely in Russian, including the module description and command guidance, which effectively imposes a specific language on users. The policy allows locale constraints only when clearly justified or when users are given a language/locale choice, neither of which is present here.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The module docstring and user-facing command descriptions are entirely in Russian, and all runtime messages later in the file are also Russian-only. This imposes a specific language on users without opt-in or an explanation that the skill is intentionally region-specific, matching the locale-policy violation criterion.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The module docstring and user-facing command descriptions are entirely in Russian, indicating the skill is designed to communicate in a fixed language. The policy allows locale constraints only when the user is offered a choice or the constraint is clearly documented and justified; neither appears here.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The documentation promises that HTML is produced only on request, but the implementation later writes HTML unconditionally. This mismatch is security-relevant because operators and downstream tooling may rely on the documented behavior and fail to protect or clean up an additional output artifact containing report content.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The code explicitly treats English text in findings/questions as an error and instructs users to translate it to Russian. This enforces a specific language policy across outputs, and the file does not offer a user language choice or indicate that the skill is region-specific only.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The rendered document hardcodes the heading 'Резюме для руководства.' and the surrounding file-level instructions describe the product entirely as Russian output. This is a natural-language locale constraint with no opt-in or configurable language selection.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script always renders and writes an HTML copy of the summary even though the documented deliverable is primarily a PDF and the module docstring says HTML should be saved only on request. HTML exports broaden the data exposure surface because they create an extra plaintext-like artifact that may be easier to read, index, exfiltrate, or mishandle than the intended PDF output.

Static analysis

No suspicious patterns detected.