Fundreport Scrape

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:32 AM UTC
• Version: 1.0.0

Overview

This skill fits its PDF-to-Excel purpose, but it needs review because its installer asks for root access and its interaction rules can start processing files too broadly.

Review the installer before running it. Prefer installing Tesseract and Poppler with your system package manager, then install Python packages in a non-root virtual environment with pinned versions. Use narrow, intentional input folders and explicit output paths, and treat generated Excel files as sensitive financial documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/install_ocr_deps.sh:49
• Finding: Unpinned Python Dependencies Installed with Root Privileges<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install_ocr_deps.sh:9-14,49`; related mutable dependency declarations in `requirements.txt:4-9` **Vulnerability Type**: Unsafe privileged dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # scripts/install_ocr_deps.sh:10-14 if [ "$EUID" -ne 0 ]; then echo "⚠️ 请使用 sudo 运行此脚本" echo "用法：sudo ./install_ocr_deps.sh" exit 1 fi ``` ```bash # scripts/install_ocr_deps.sh:49 pip install pdf2image Pillow opencv-python-headless ``` ```text # requirements.txt:4-9 openpyxl>=3.0.0 pdfplumber>=0.7.0 pdf2image>=1.16.0 pytesseract>=0.3.10 Pillow>=9.0.0 opencv-python-headless>=4.5.0 ``` ### Technical Analysis The installation script refuses to run unless it has root privileges and subsequently invokes `pip` within that privileged process. The requested Python packages are not pinned to exact reviewed versions, and no package hashes or lock file are used. The dependency constraints in `requirements.txt` also allow any future version equal to or newer than the specified minimum. Python package installation may execute package build hooks and other installation-time code. Running this process as root means such code receives unrestricted system privileges. Because dependency resolution is mutable, the code ultimately installed can change after the Skill has been reviewed. Root access is reasonably necessary for the `yum` system-package operation, but it is not necessary for Python dependencies. Combining both operations in one root-only installer exceeds the minimum privileges required for the Skill's declared PDF and OCR functionality. ### Attack Path 1. A user follows the project documentation and executes `sudo ./scripts/install_ocr_deps.sh`. 2. The script verifies that it is running as root. 3. The unqualified `pip` command contacts its configured package index and resolves the latest packages satisfying the mutable constraints. 4. An attacker compromises a dependency release ...[truncated 1177 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Separate system-package installation from Python dependency installation. 2. Restrict the privileged section to the required system command, such as: ```bash sudo yum install -y tesseract tesseract-langpack-chi_simp tesseract-osd poppler-utils ``` 3. Create a dedicated non-root virtual environment for Python dependencies: ```bash python3 -m venv .venv .venv/bin/python -m pip install --require-hashes -r requirements.lock ``` 4. Pin every direct and transitive dependency to an exact reviewed version. 5. Generate and retain a lock file containing cryptographic hashes for all distributions. 6. Use `python3 -m pip` rather than an unqualified `pip` executable to prevent interpreter ambiguity. 7. Document the expected package index and reject untrusted or unexpected indexes. 8. Run dependency vulnerability and provenance checks during release preparation. 9. Remove the requirement that the entire installer run as root; fail if Python installation is attempted with effective UID zero. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (44)

Vague Triggers

High

• Confidence: 99% confidence
• Finding: The logic that starts processing on any non-file message is a broad activation flaw because ordinary messages such as questions, corrections, or comments would trigger execution. This is especially dangerous here because the skill processes uploaded documents and produces outputs, so a user saying something unrelated like "等一下" or "这个文件有问题" could unintentionally launch processing on partial or wrong files.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly instructs users to execute a local shell script with sudo, granting it full root privileges, but provides no explanation of what system changes will occur or how to review the script first. In the context of an agent skill downloaded into a user-writable skills directory, this increases the risk of privilege escalation if the script is modified, malicious, or simply unsafe.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
cd ~/.agents/skills/fundreport-scrape
sudo ./scripts/install_ocr_deps.sh
```

### 运行处理

• Confidence: 92% confidence
• Finding: The documented command uses sudo to run an installer script from the skill directory, meaning any commands in that script will run as root. Because the instruction appears in skill documentation for a PDF/OCR extraction tool, root access is not obviously necessary for core functionality, so this creates avoidable risk and makes compromise of the script or directory materially more dangerous.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **Temporary files:** PDF to image conversions stored in `/tmp/` (auto-cleaned)
- **Output files:** Excel files in user-specified locations
- **No hidden files:** Does not create hidden files or modify system configs

### Privilege Requirements

• Confidence: 60% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

- **Temporary files:** PDF to image conversions stored in `/tmp/` (auto-cleaned)
- **Output files:** Excel files in user-specified locations
- **No hidden files:** Does not create hidden files or modify system configs

### Privilege Requirements

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**System dependencies (manual install required):**
```bash
# Ubuntu/Debian
sudo apt-get install tesseract-ocr tesseract-ocr-chi-sim poppler-utils

# macOS
brew install tesseract tesseract-lang poppler

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**System dependencies (manual install required):**
```bash
# Ubuntu/Debian
sudo apt-get install tesseract-ocr tesseract-ocr-chi-sim poppler-utils

# macOS
brew install tesseract tesseract-lang poppler

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documentation describes file-processing behavior over user-supplied Excel and PDF inputs, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity: a runtime may grant broader file access than users expect, increasing the chance of unintended reads from the local filesystem during execution.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger logic is broad enough to activate on ordinary messages that merely contain a filesystem path or generic folder-processing wording. In this skill, activation leads to scanning a directory, reading all matching PDFs/XLSX files, and generating new output files, so an accidental match could cause unintended bulk access to local data and unexpected file creation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document states that outputs are written either into the source folder or a remote outbound directory, but does not clearly warn users up front that running the skill will create new Excel files in those locations. This can lead to unintended data persistence or transfer of extracted report contents, especially when the source PDFs may contain sensitive financial information.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This markdown file contains user-facing instructions exclusively in Chinese, starting from the title and continuing throughout the document. Under the policy rules, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 72% confidence
• Finding: The file presents all interaction rules, trigger phrases, and user-facing examples exclusively in Chinese, including required confirmation phrases, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: Using the single trigger word "处理" is overly broad in a chat workflow because it can appear in ordinary discussion, clarification, or error recovery rather than as explicit consent to start processing files. In a file-processing skill that may read PDFs and generate Excel outputs, this creates a real risk of unintended execution before the user has finished uploading materials.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document describes timeout-based automatic processing but does not provide a strong, consistently surfaced warning that inactivity will trigger document handling. That weak disclosure increases the likelihood that users will not understand when their files are being processed, undermining informed consent in a workflow involving potentially sensitive financial PDFs and spreadsheet generation.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Starting automatically after 30 seconds of inactivity is an ambiguous activation rule because silence does not reliably indicate user intent. In this skill's context, users may upload files slowly, switch apps, or pause during multi-file submission, causing premature processing on incomplete or unintended inputs.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file hard-codes OCR to use 'chi_sim+eng', and later defines OCR_LANG as Simplified Chinese plus English, making a specific language/locale mandatory. This is a natural-language policy concern because the skill does not offer user opt-in or explain that it is limited to Chinese/English documents only.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The dependency section requires installation and validation of the Chinese OCR language pack, presenting it as mandatory for the workflow. Because the document does not provide an option to choose other OCR languages or justify a region-specific scope, it imposes a locale preference without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This markdown file presents all instructions, examples, and operational guidance exclusively in Chinese, which can amount to forcing a specific language on users without opt-in. The policy category explicitly covers language or locale constraints unless the file offers a choice or explains a justified region-specific limitation, which is not present here.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs generation of a 'PDF信息Excel' containing all extracted PDF data, which can unnecessarily replicate sensitive or confidential source content into a new artifact. If source PDFs contain personal, financial, proprietary, or regulated information, the generated Excel broadens exposure surface, increases retention risk, and may disclose data beyond the minimum needed for the user's template-filling task.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The script sets `self.ocr_lang = 'chi_sim+eng'`, which enforces a specific language/locale configuration for OCR behavior. Under the policy, forcing a language or locale without user opt-in or clear justification is a natural-language policy violation, and this file does not present a user choice or explain that the tool is intentionally limited to Chinese/English documents.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 检查是否以 root 运行
if [ "$EUID" -ne 0 ]; then
  echo "⚠️  请使用 sudo 运行此脚本"
  echo "用法：sudo ./install_ocr_deps.sh"
  exit 1
fi

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 检查是否以 root 运行
if [ "$EUID" -ne 0 ]; then
  echo "⚠️  请使用 sudo 运行此脚本"
  echo "用法：sudo ./install_ocr_deps.sh"
  exit 1
fi

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 检查是否以 root 运行
if [ "$EUID" -ne 0 ]; then
  echo "⚠️  请使用 sudo 运行此脚本"
  echo "用法：sudo ./install_ocr_deps.sh"
  exit 1
fi

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 检查是否以 root 运行
if [ "$EUID" -ne 0 ]; then
  echo "⚠️  请使用 sudo 运行此脚本"
  echo "用法：sudo ./install_ocr_deps.sh"
  exit 1
fi

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 检查是否以 root 运行
if [ "$EUID" -ne 0 ]; then
  echo "⚠️  请使用 sudo 运行此脚本"
  echo "用法：sudo ./install_ocr_deps.sh"
  exit 1
fi

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.