DocToSkill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:34 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform the advertised document-to-skill conversion, but it needs review because untrusted document text can influence generated skills and the build step can package unintended asset files.

Install only in a trusted workspace and use fresh task directories. Treat input documents as untrusted: review generated skills before sharing or installing them, and do not allow attacker-controlled files or symlinks in the assets directory. Ensure PDFTOPPM_BIN is unset or points to a trusted pdftoppm binary.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/build_skill.py:259

Finding

Untrusted Document Content Can Influence Agent Instructions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/build_skill.py:382

Finding

Generated Archive Includes Unreferenced Assets and May Follow Symbolic Links

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents an end-to-end document-to-skill conversion utility. The supplied code chunk is only a batching/orchestration component within an indexing pipeline: it reads an existing manifest, groups chunks into batches, emits payloads for batch-part creation, validates resulting batch parts, handles retries, and produces a compact outline. While this may support creation of a grounded knowledge index, it does not itself convert source documents, extract images, normalize Markdown, or build a skill zip. The primary purpose of this code is materially narrower and different from the declared description, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code clearly implements document conversion to Markdown plus asset extraction, which partially matches the declared description. It supports TXT/Markdown/DOCX/PDF, extracts images from DOCX/PDF, renders scanned PDF pages, and writes a JSONL manifest of converted documents. However, key declared outputs and workflow claims are absent: there is no packaging into a skill zip, no substantive grounded knowledge index construction (only a simple documents.jsonl manifest with metadata like paths/counts), and no logic related to invoking the skill before inspecting task files or avoiding directory listings. Thus the declared description overstates the implemented capability in materially important ways.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The code is related to document-to-skill preparation, so the overall domain matches the description. However, this specific chunk is only an orchestration/preparation wrapper. It invokes other scripts to convert documents, split markdown, and plan batches, then emits compact workflow state. There is no logic here for packaging a reusable skill zip, and no direct creation of a final knowledge index artifact as described. It also includes resumable workflow behavior and a policy message about not reading chunk/state files directly, which are not part of the declared purpose. Because the declared description presents a fuller end-to-end conversion capability than this code chunk actually implements, this is a material mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is focused on document-to-skill conversion: ingesting source files, normalizing them to Markdown, extracting images, and building a reusable skill package and JSONL index. This code does none of that generation work. Instead, it assumes an index already exists, reads the JSONL file, tokenizes and scores query terms, and returns ranked search results. That is a materially different primary purpose—index search/retrieval rather than document conversion/building—so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

guarantees the zip contains `SKILL.md`, `agents/openai.yaml`, the index, source Markdown, retrieval script, and every

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is described as converting documents into normalized Markdown, extracted images, and an index, but this implementation invokes the external pdftoppm executable via subprocess.run to render PDF pages. Spawning subprocesses is a broader capability than a typical in-process document parser and is not justified explicitly by the manifest's stated scope.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/convert_documents.py (reported line 256)May include surrounding context.

python

str(path),
        str(prefix),
    ]
    result = subprocess.run(command, capture_output=True, text=True, timeout=120, check=False)
    if result.returncode != 0 or not rendered.is_file():
        rendered.unlink(missing_ok=True)
        detail = (result.stderr or result.stdout or "unknown pdftoppm error").strip()

Tainted flow: 'command' from os.environ.get (line 246, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 91% confidence

Finding

The executable path comes from the PDFTOPPM_BIN environment variable and is then executed without validation. In environments where untrusted users or upstream workflows can influence environment variables, this enables arbitrary program execution under the agent's privileges when PDF conversion is triggered.

Content

Scanner excerpt · scripts/convert_documents.py (reported line 256)May include surrounding context.

python

str(path),
        str(prefix),
    ]
    result = subprocess.run(command, capture_output=True, text=True, timeout=120, check=False)
    if result.returncode != 0 or not rendered.is_file():
        rendered.unlink(missing_ok=True)
        detail = (result.stderr or result.stdout or "unknown pdftoppm error").strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_workflow.py (reported line 26)May include surrounding context.

python

def run_stage(script: str, arguments: list[str]) -> None:
    command = [sys.executable, str(SCRIPT_DIR / script), *arguments]
    completed = subprocess.run(
        command,
        check=False,
        capture_output=True,

Static analysis

No suspicious patterns detected.