Nutrient Document Processing (Universal Agent Skill)

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:21 AM UTC
• Version: 1.1.2

Overview

This is a coherent document-processing skill, but users should treat uploaded documents and the unpinned MCP package setup with care.

Install only if you are comfortable sending selected documents, form data, redaction targets, and signing inputs to Nutrient's cloud API. Use a narrow SANDBOX_PATH, avoid highly sensitive or regulated files unless third-party processing is approved, and prefer pinning or preinstalling a reviewed MCP server version instead of relying on unpinned npx at runtime.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:58
• Finding: Unpinned npm Package Downloaded and Executed at Runtime## Vulnerability Details **File Location**: `SKILL.md`, lines 58–59 and 87 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable code:** ```json "command": "npx", "args": ["-y", "@nutrient-sdk/dws-mcp-server"], ``` ```text - MCP server mode (`npx @nutrient-sdk/dws-mcp-server`) downloads the official Nutrient MCP server package from npm at runtime. ``` ### Technical Analysis The recommended MCP configuration invokes `npx -y` without specifying an exact package version or verifying package integrity. Each installation can therefore download and execute whichever package release currently resolves under the `@nutrient-sdk/dws-mcp-server` name. The artifact does not contain a lockfile, integrity hash, vendored implementation, or exact version constraint that would make dependency resolution reproducible. Although the package is described as official, a compromised npm publisher account, malicious upstream release, or other supply-chain incident could change the code executed after this skill has been reviewed. The `-y` option automatically accepts the installation, reducing the opportunity for users to inspect the resolved version before execution. ### Attack Path 1. An attacker compromises the upstream npm publisher account, package distribution process, or a future package release. 2. The attacker publishes a malicious version under `@nutrient-sdk/dws-mcp-server`. 3. A user starts the MCP server using the documented `npx -y` configuration. 4. npm resolves and downloads the mutable package version without an exact version or integrity pin. 5. The malicious package executes locally with the privileges of the user running the MCP client. 6. The package may access inherited environment variables, including `NUTRIENT_DWS_API_KEY`, and files available through the configured sandbox or process permissions. ### Impact Assessment Successful exploitation could result in arbitrary c ...[truncated 668 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to an exact reviewed version, such as: ```json "args": ["-y", "@nutrient-sdk/dws-mcp-server@X.Y.Z"] ``` 2. Use a lockfile and npm integrity metadata where the MCP client deployment model permits it. 3. Prefer installing the dependency through a controlled build process rather than downloading it whenever the MCP server starts. 4. Verify package provenance, signatures, and integrity before installation. 5. Upgrade only through a documented review process that examines dependency changes before deployment. 6. Avoid automatic installation acceptance where practical, or validate the resolved package version before execution. 7. Configure `SANDBOX_PATH` to the narrowest directory required for the current task. 8. Provide the MCP process only the required API key and avoid exposing unrelated credentials through inherited environment variables. 9. Run the MCP server under a dedicated, least-privileged operating-system account or isolated container. 10. Monitor npm advisories and upstream repository releases for package compromise or unexpected ownership changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (23)

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The activation keywords are extremely broad (`PDF`, `document`, `extract`, `sign`, `merge`, etc.), so the skill may trigger in many ordinary conversations that are not intended to invoke a networked document-processing workflow. In an agent setting, overbroad triggering increases the chance of unintended external document transmission or invocation of risky operations on sensitive files.

External Transmission

Medium

• Category: Data Exfiltration

Content

export NUTRIENT_API_KEY="your_api_key_here"
```

All requests go to `https://api.nutrient.io/build` as multipart POST with an `instructions` JSON field.


## Safety Boundaries

• Confidence: 93% confidence
• Finding: This section explicitly states that requests go to `https://api.nutrient.io/build`, meaning documents and extracted content are transmitted to an external service. In a document-processing skill, that is expected functionality, but it is still a real data-exfiltration boundary that can expose sensitive files, OCR text, key-value extractions, and PII to a third party if invoked without informed consent.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill instructs users to execute an MCP server via `npx @nutrient-sdk/dws-mcp-server` without pinning a specific version. This creates a supply-chain risk: the package resolved at runtime could change unexpectedly or be compromised, and the skill is specifically positioned to process sensitive local documents, increasing the consequences of malicious package updates.

External Transmission

Medium

• Category: Data Exfiltration

Content

**HTML to PDF:**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "index.html=@index.html" \
  -F 'instructions={"parts":[{"html":"index.html"}]}' \

• Confidence: 92% confidence
• Finding: The HTML-to-PDF example uploads local content to an external API endpoint. Even though this is the intended service model, it creates a genuine external transmission risk because documents may contain secrets, internal URLs, embedded tokens, or proprietary content that leaves the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

**DOCX to PDF:**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.docx=@document.docx" \
  -F 'instructions={"parts":[{"file":"document.docx"}]}' \

• Confidence: 92% confidence
• Finding: The DOCX-to-PDF workflow sends a local Office document to a remote service for processing. This can expose confidential business content, tracked changes, comments, hidden metadata, or embedded objects if the skill is triggered on sensitive files.

External Transmission

Medium

• Category: Data Exfiltration

Content

**PDF to DOCX/XLSX/PPTX:**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"output":{"type":"docx"}}' \

• Confidence: 92% confidence
• Finding: The PDF conversion example uploads the source PDF externally for transformation into another format. Because PDFs often contain sensitive text, annotations, forms, or attachments, this is a real confidentiality boundary and can lead to unauthorized third-party exposure if used casually by an agent.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Image to PDF:**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "image.jpg=@image.jpg" \
  -F 'instructions={"parts":[{"file":"image.jpg"}]}' \

• Confidence: 91% confidence
• Finding: The image-to-PDF example sends local images to an external API. Images may contain personal data, credentials, screenshots, IDs, or other sensitive visual content, so remote upload is a substantive security and privacy concern even if the endpoint is legitimate.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Extract plain text:**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"output":{"type":"text"}}' \

• Confidence: 95% confidence
• Finding: The plain-text extraction workflow uploads documents and returns extracted text, which can materially amplify data exposure by converting complex files into easily searchable plaintext. In an agent environment, this increases the risk of accidental disclosure of confidential contents to external services and downstream toolchains.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Extract tables (as JSON, CSV, or Excel):**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"output":{"type":"xlsx"}}' \

• Confidence: 94% confidence
• Finding: The table extraction example uploads documents to a remote service and outputs structured data such as spreadsheets. Structured extraction increases sensitivity because internal financial, HR, medical, or operational data becomes easier to analyze and exfiltrate once normalized.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Extract key-value pairs:**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"extraction","strategy":"key-values"}]}' \

• Confidence: 95% confidence
• Finding: Key-value extraction sends documents externally and derives structured fields that may include account numbers, identities, addresses, or other sensitive records. This is more dangerous than simple conversion because it transforms potentially private document contents into machine-friendly data suitable for automation or misuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

Apply OCR to scanned PDFs or images, producing searchable PDFs with selectable text.

```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "scanned.pdf=@scanned.pdf" \
  -F 'instructions={"parts":[{"file":"scanned.pdf"}],"actions":[{"type":"ocr","language":"english"}]}' \

• Confidence: 93% confidence
• Finding: OCR of scanned files requires transmission of the scanned document or image to an external service. Since scanned inputs often contain passports, contracts, medical forms, or handwritten notes, this creates a meaningful privacy and confidentiality risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Pattern-based redaction** (preset patterns):
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"redaction","strategy":"preset","preset":"social-security-number"}]}' \

• Confidence: 94% confidence
• Finding: Pattern-based redaction still requires uploading the original unredacted document to the external API, so the service sees the sensitive data before it is redacted. This can create a false sense of safety because users may believe the operation protects secrecy while the raw source has already left the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Regex-based redaction:**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"redaction","strategy":"regex","regex":"\\b[A-Z]{2}\\d{6}\\b"}]}' \

• Confidence: 94% confidence
• Finding: Regex-based redaction also transmits the original unredacted document to a third party. Because users may use custom regexes to target secrets, IDs, or proprietary identifiers, the skill facilitates remote handling of exactly the kinds of sensitive data they are trying to protect.

External Transmission

Medium

• Category: Data Exfiltration

Content

**AI-powered PII redaction:**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"ai_redaction","criteria":"All personally identifiable information"}]}' \

• Confidence: 96% confidence
• Finding: AI-powered PII redaction is especially sensitive because it uploads documents specifically to identify personally identifiable information. That means the external service receives potentially high volumes of sensitive personal data, and the natural-language criteria may encourage broad scanning of confidential records.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Text watermark:**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"watermark","text":"CONFIDENTIAL","fontSize":48,"fontColor":"#FF0000","opacity":0.5,"rotation":45,"width":"50%","height":"50%"}]}' \

• Confidence: 90% confidence
• Finding: The watermarking example sends a PDF externally for modification. While generally less sensitive than extraction, it still transmits the full source document to a third party, which may be problematic for confidential or internal materials.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Image watermark:**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F "logo.png=@logo.png" \

• Confidence: 90% confidence
• Finding: Image watermarking transmits both the source PDF and watermark image to the external API. If either contains confidential branding assets, internal documents, or sensitive imagery, this creates third-party exposure beyond the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Sign a PDF with CMS signature:**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"sign","signatureType":"cms","signerName":"John Doe","reason":"Approval","location":"New York"}]}' \

• Confidence: 95% confidence
• Finding: Digital-signature workflows upload documents intended for signing to an external service, which is highly sensitive because signed documents often carry legal, financial, or contractual significance. Depending on the signing model, this may also create integrity and trust-boundary concerns if users do not fully understand where signing operations occur.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Sign with CAdES-B-LT (long-term validation):**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"sign","signatureType":"cades","cadesLevel":"b-lt","signerName":"Jane Smith"}]}' \

• Confidence: 95% confidence
• Finding: Long-term validation signing similarly transmits potentially sensitive legal documents to a remote service. Because these workflows imply stronger evidentiary and compliance properties, misuse or misunderstanding of the external trust boundary can have significant legal and security consequences.

External Transmission

Medium

• Category: Data Exfiltration

Content

Fill PDF form fields using Instant JSON format:
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "form.pdf=@form.pdf" \
  -F 'instructions={"parts":[{"file":"form.pdf"}],"actions":[{"type":"fillForm","fields":[{"name":"firstName","value":"John"},{"name":"lastName","value":"Doe"},{"name":"email","value":"[e-mail]"}]}]}' \

• Confidence: 94% confidence
• Finding: Form filling uploads the original form and the field values, which commonly contain names, email addresses, addresses, tax IDs, or other sensitive user-supplied data. This is a material privacy risk because both the template and the populated personal data are sent to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Merge multiple PDFs:**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "doc1.pdf=@doc1.pdf" \
  -F "doc2.pdf=@doc2.pdf" \

• Confidence: 91% confidence
• Finding: Merging PDFs uploads multiple source documents to an external service in a single request. This can compound data exposure by aggregating separate confidential files into one remote processing event.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Extract specific pages:**
```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf","pages":{"start":0,"end":4}}]}' \

• Confidence: 91% confidence
• Finding: Page extraction still requires uploading the entire source PDF to the remote API, even if only selected pages are returned. Users may incorrectly assume that only the specified pages are disclosed, when the complete file may be accessible to the service during processing.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 9. Render PDF Pages as Images

```bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf","pages":{"start":0,"end":0}}],"output":{"type":"png","dpi":300}}' \

• Confidence: 91% confidence
• Finding: Rendering a page as an image transmits the source PDF to the external service. Even if only one page is requested in output, the remote processor may still receive the full document, creating a confidentiality boundary users might overlook.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 10. Check Credits

```bash
curl -X GET https://api.nutrient.io/credits \
  -H "Authorization: Bearer $NUTRIENT_API_KEY"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.