Fundreport Scrape

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:32 AM UTC
• Version: 1.0.0

Overview

This skill fits its PDF-to-Excel purpose, but it needs review because its installer asks for root access and its interaction rules can start processing files too broadly.

Review the installer before running it. Prefer installing Tesseract and Poppler with your system package manager, then install Python packages in a non-root virtual environment with pinned versions. Use narrow, intentional input folders and explicit output paths, and treat generated Excel files as sensitive financial documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/install_ocr_deps.sh:49

Finding

Unpinned Python Dependencies Installed with Root Privileges

Content

View full analysis

=3.0.0 pdfplumber>=0.7.0 pdf2image>=1.16.0 pytesseract>=0.3.10 Pillow>=9.0.0 opencv-python-headless>=4.5.0 ``` ### Technical Analysis The installation script refuses to run unless it has root privileges and subsequently invokes `pip` within that privileged process. The requested Python packages are not pinned to exact reviewed versions, and no package hashes or lock file are used. The dependency constraints in `requirements.txt` also allow any future version equal to or newer than the specified minimum. Python package installation may execute package build hooks and other installation-time code. Running this process as root means such code receives unrestricted system privileges. Because dependency resolution is mutable, the code ultimately installed can change after the Skill has been reviewed. Root access is reasonably necessary for the `yum` system-package operation, but it is not necessary for Python dependencies. Combining both operations in one root-only installer exceeds the minimum privileges required for the Skill's declared PDF and OCR functionality. ### Attack Path 1. A user follows the project documentation and executes `sudo ./scripts/install_ocr_deps.sh`. 2. The script verifies that it is running as root. 3. The unqualified `pip` command contacts its configured package index and resolves the latest packages satisfying the mutable constraints. 4. An attacker compromises a dependency release ...[truncated 1177 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (44)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The logic that starts processing on any non-file message is a broad activation flaw because ordinary messages such as questions, corrections, or comments would trigger execution. This is especially dangerous here because the skill processes uploaded documents and produces outputs, so a user saying something unrelated like "等一下" or "这个文件有问题" could unintentionally launch processing on partial or wrong files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README explicitly instructs users to execute a local shell script with sudo, granting it full root privileges, but provides no explanation of what system changes will occur or how to review the script first. In the context of an agent skill downloaded into a user-writable skills directory, this increases the risk of privilege escalation if the script is modified, malicious, or simply unsafe.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The documented command uses sudo to run an installer script from the skill directory, meaning any commands in that script will run as root. Because the instruction appears in skill documentation for a PDF/OCR extraction tool, root access is not obviously necessary for core functionality, so this creates avoidable risk and makes compromise of the script or directory materially more dangerous.

Content

Scanner excerpt · README.md (reported line 52)May include surrounding context.

bash

cd ~/.agents/skills/fundreport-scrape
sudo ./scripts/install_ocr_deps.sh

运行处理

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY_REVIEW.md (reported line 132)May include surrounding context.

md

- **Temporary files:** PDF to image conversions stored in `/tmp/` (auto-cleaned)
- **Output files:** Excel files in user-specified locations
- **No hidden files:** Does not create hidden files or modify system configs

### Privilege Requirements

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY_REVIEW.md (reported line 132)May include surrounding context.

md

- **Temporary files:** PDF to image conversions stored in `/tmp/` (auto-cleaned)
- **Output files:** Excel files in user-specified locations
- **No hidden files:** Does not create hidden files or modify system configs

### Privilege Requirements

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY_REVIEW.md (reported line 258)May include surrounding context.

System dependencies (manual install required):

bash

# Ubuntu/Debian
sudo apt-get install tesseract-ocr tesseract-ocr-chi-sim poppler-utils

# macOS
brew install tesseract tesseract-lang poppler

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/ocr_rules.md (reported line 327)May include surrounding context.

System dependencies (manual install required):

bash

# Ubuntu/Debian
sudo apt-get install tesseract-ocr tesseract-ocr-chi-sim poppler-utils

# macOS
brew install tesseract tesseract-lang poppler

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documentation describes file-processing behavior over user-supplied Excel and PDF inputs, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity: a runtime may grant broader file access than users expect, increasing the chance of unintended reads from the local filesystem during execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger logic is broad enough to activate on ordinary messages that merely contain a filesystem path or generic folder-processing wording. In this skill, activation leads to scanning a directory, reading all matching PDFs/XLSX files, and generating new output files, so an accidental match could cause unintended bulk access to local data and unexpected file creation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document states that outputs are written either into the source folder or a remote outbound directory, but does not clearly warn users up front that running the skill will create new Excel files in those locations. This can lead to unintended data persistence or transfer of extracted report contents, especially when the source PDFs may contain sensitive financial information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file contains user-facing instructions exclusively in Chinese, starting from the title and continuing throughout the document. Under the policy rules, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The file presents all interaction rules, trigger phrases, and user-facing examples exclusively in Chinese, including required confirmation phrases, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Using the single trigger word "处理" is overly broad in a chat workflow because it can appear in ordinary discussion, clarification, or error recovery rather than as explicit consent to start processing files. In a file-processing skill that may read PDFs and generate Excel outputs, this creates a real risk of unintended execution before the user has finished uploading materials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document describes timeout-based automatic processing but does not provide a strong, consistently surfaced warning that inactivity will trigger document handling. That weak disclosure increases the likelihood that users will not understand when their files are being processed, undermining informed consent in a workflow involving potentially sensitive financial PDFs and spreadsheet generation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Starting automatically after 30 seconds of inactivity is an ambiguous activation rule because silence does not reliably indicate user intent. In this skill's context, users may upload files slowly, switch apps, or pause during multi-file submission, causing premature processing on incomplete or unintended inputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file hard-codes OCR to use 'chi_sim+eng', and later defines OCR_LANG as Simplified Chinese plus English, making a specific language/locale mandatory. This is a natural-language policy concern because the skill does not offer user opt-in or explain that it is limited to Chinese/English documents only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The dependency section requires installation and validation of the Chinese OCR language pack, presenting it as mandatory for the workflow. Because the document does not provide an option to choose other OCR languages or justify a region-specific scope, it imposes a locale preference without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file presents all instructions, examples, and operational guidance exclusively in Chinese, which can amount to forcing a specific language on users without opt-in. The policy category explicitly covers language or locale constraints unless the file offers a choice or explains a justified region-specific limitation, which is not present here.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly instructs generation of a 'PDF信息Excel' containing all extracted PDF data, which can unnecessarily replicate sensitive or confidential source content into a new artifact. If source PDFs contain personal, financial, proprietary, or regulated information, the generated Excel broadens exposure surface, increases retention risk, and may disclose data beyond the minimum needed for the user's template-filling task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sets self.ocr_lang = 'chi_sim+eng', which enforces a specific language/locale configuration for OCR behavior. Under the policy, forcing a language or locale without user opt-in or clear justification is a natural-language policy violation, and this file does not present a user choice or explain that the tool is intentionally limited to Chinese/English documents.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY_REVIEW.md (reported line 95)May include surrounding context.

md

# 检查是否以 root 运行
if [ "$EUID" -ne 0 ]; then
  echo "⚠️  请使用 sudo 运行此脚本"
  echo "用法：sudo ./install_ocr_deps.sh"
  exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY_REVIEW.md (reported line 137)May include surrounding context.

md

# 检查是否以 root 运行
if [ "$EUID" -ne 0 ]; then
  echo "⚠️  请使用 sudo 运行此脚本"
  echo "用法：sudo ./install_ocr_deps.sh"
  exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY_REVIEW.md (reported line 190)May include surrounding context.

md

# 检查是否以 root 运行
if [ "$EUID" -ne 0 ]; then
  echo "⚠️  请使用 sudo 运行此脚本"
  echo "用法：sudo ./install_ocr_deps.sh"
  exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY_REVIEW.md (reported line 208)May include surrounding context.

md

# 检查是否以 root 运行
if [ "$EUID" -ne 0 ]; then
  echo "⚠️  请使用 sudo 运行此脚本"
  echo "用法：sudo ./install_ocr_deps.sh"
  exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install_ocr_deps.sh (reported line 13)May include surrounding context.

sh

# 检查是否以 root 运行
if [ "$EUID" -ne 0 ]; then
  echo "⚠️  请使用 sudo 运行此脚本"
  echo "用法：sudo ./install_ocr_deps.sh"
  exit 1
fi

Static analysis

No suspicious patterns detected.