TextIn xParse Document Parse

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:29 AM UTC
• Version: 0.1.4

Overview

The skill is a coherent document-parsing connector, but it needs review because it sends sensitive document-related data to a remote service and includes under-scoped handling for request context, passwords, and standalone installation.

Install only if you are comfortable sending selected documents, parse outputs, task metadata, and WorkBuddy task context to the TextIn xParse service. Prefer the connector-managed pinned CLI; if using standalone npm, pin the version and avoid unnecessary mirrors. Do not paste real secrets into shared logs or transcripts, and be cautious with password-protected documents because the documented password flow uses command-line arguments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:325

Finding

Unpinned Global Installation of a Third-Party CLI

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/task-runtime.md:186

Finding

Document Passwords Passed Through Process Command-Line Arguments

Content

View full analysis

--password # Multiple Task Resources; repeat the flag once per protected Resource. xparse-cli task continue \ --password = \ --password = ``` `continue` updates access only for matched resources and reruns those resources. It submits the selected rerun and returns by default. Preserve the new Run ID, poll it separately, then call `task export --run-id --output ./task-output` after completion. `continue --output` is valid only together with explicit `--wait`. It does not reparse already successful files. Never put passwords in `--config`, telemetry, logs, command examples with real values, or the final answer. ``` Equivalent password arguments are also documented in `SKILL.md:186-187`, `SKILL.md:290`, `SKILL.md:301-302`, `references/cli-guidance.md:86`, and `references/error-handling.md:96-110`. ### Technical Analysis The Skill directs the agent to interpolate document passwords into the `--password` command-line option. Command-line arguments are not an appropriate secret transport mechanism because they may be exposed through: - ...[truncated 1495 chars]

Remediation

View remediation

other

Warning

• Location: SKILL.md:25

Finding

Original User Request Is Mandatorily Added to Remote Task Context

Content

View full analysis

` only on the first xParse invocation for that request. - Delete the temporary file after that invocation. Later commands inherit the task. ``` ### Technical Analysis The Skill requires the complete original wording of every WorkBuddy request to be copied into a task-context file and supplied to the first `xparse-cli` invocation. Because the CLI is the remote parsing and task execution client, this adds request text to the service operation in addition to the selected document. A user's original request can include names, account identifiers, case details, internal project names, medical or financial context, or other information not needed to parse the document. Preserving the wording verbatim conflicts with data minimization: remote parsing generally requires the selected document and parsing parameters, not the complete natural-language request. The temporary file uses an appropriate `0600` mode and is deleted after invocation, which mitigates local disclosure. It does not address remote disclosure, retention, access, or correlation of the task metadata. ### Attack Path 1. A user submits a request containing confidential contextual information. 2. The Skill copies the request verbatim into the `user_intent` field. 3. The private temporary file is passed to ` ...[truncated 787 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/authentication.md (reported line 33)May include surrounding context.

md

The Skill must not:

- request, store, or repeat an Access Token, Refresh Token, Secret Code, or
  private `device_code`;
- implement its own callback listener, token polling, or HTTP client;
- start browser PKCE as an automatic fallback from Device OAuth;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/authentication.md (reported line 118)May include surrounding context.

xparse-cli auth logout --method all

text

Status is local and does not make a network request. An expired access token
with a still-usable refresh token remains logged in; the next paid OAuth parse
refreshes it. Logout attempts RFC 7009 remote revocation first (Refresh Token
preferred) and then removes the local token. A remote failure is a stderr

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents options that include character-level OCR details, image URLs/Base64 data, and page preview images, all of which can expose sensitive document contents or metadata. The reference does not provide any warning or disclosure about handling potentially sensitive output, despite SQP-2 requiring warnings in markdown when behavior could affect user data or privacy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation instructs users to check environment variables XPARSE_APP_ID and XPARSE_SECRET_CODE, indicating use of credentials, but does not warn users to keep these secrets out of logs, shell history, or shared outputs. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors affecting privacy or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file includes commands to export XPARSE_APP_ID and XPARSE_SECRET_CODE, which are credentials, but does not warn users that environment variables may expose secrets through shell history, process inspection, or persistent session configuration. Because SQP-2 applies to markdown files when privacy-sensitive behavior lacks warnings, this omission is a user-facing safety concern.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/task-runtime.md (reported line 44)May include surrounding context.

md

approved paid execution.
- `auto` and `free` use the Agent free-first Task endpoint and fail closed. An
  overseas environment may explicitly return `TASK_FREE_MODE_UNAVAILABLE` when
  no equivalent free billing source exists. Never retry as `paid` without
  approval and never replace the batch with serial `parse` commands.
- One `operation_id` identifies one logical submission. The CLI namespaces it
  into upload, Task, and Run idempotency keys. For

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file documents --output ./result/ and states that the CLI creates directories and writes files, but it does not warn that parsed output may contain sensitive document contents or metadata that will be stored on disk. For markdown descriptions, SQP-2 calls for warnings when behavior can affect user data or privacy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.