Security audit

docx-pdf-knowledge-parser

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local DOCX/PDF parser that writes reviewable output files, with some hardening gaps but no evidence of hidden access, exfiltration, or automatic memory modification.

Install only if you are comfortable with local document summaries and parse errors being written to the chosen output directory. Review MEMORY.candidate.md manually before importing anything into persistent memory, and avoid running the parser on untrusted or very large DOCX/PDF files unless you add size, page-count, timeout, and dependency-locking controls.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Warning

Location: run.py:22
Finding: Untrusted document content is written into a memory-oriented artifact without neutralization
Content: View full analysis
str: clean = ' '.join(text.split()) return clean[:max_len] + ('...' if len(clean) > max_len else '') def process_file(path: Path, batch_id: str): ext = path.suffix.lower() if ext == '.docx': text = extract_docx_text(path) file_type = 'docx' elif ext == '.pdf': text = extract_pdf_text(path) file_type = 'pdf' else: raise ValueError(f'unsupported extension: {ext}') if not text.strip(): raise ValueError('empty extracted text') return { 'batch_id': batch_id, 'source_file': path.name, 'source_token': '', 'file_type': file_type, 'topic': path.stem, 'content_type': detect_content_type(path.name), 'summary': summarize_text(text), 'extracted_at': utc_now(), 'confidence': 0.8, } ``` ```python mem = output_dir / 'MEMORY.candidate.md' with mem.open('w', encoding='utf-8') as f: f.write('# MEMORY Candidate\n\n') f.write(f'- batch_id: {batch_id}\n') f.write(f'- started_at: {started_at}\n') f.write(f'- finished_at: {finished_at}\n') f.write(f'- source_directory: {source_dir}\n\n') f.write('## Candidate summaries\n') for row in successes: f.write(f"### {row['source_file']}\n") f.write(f"- topic: {row['topic']}\n") f.write(f"- content_type: {row['content_type']}\n") f.write(f"- summary: {row['summary']}\n") f.write(f"- confidence: {row['confidence']}\n\n") ``` ### Technical Analysis Text extracted from an untrusted DOCX or PDF is normalized and truncated, but it is not classified as untrusted, escaped, fenced, or otherwise neutralized before being inserted ...[truncated 2143 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: parsers/parse_docx.py:6
Finding: Unbounded DOCX and PDF parsing permits resource-exhaustion attacks
Content: View full analysis
str: doc = Document(str(path)) parts = [] for p in doc.paragraphs: txt = p.text.strip() if txt: parts.append(txt) return '\n'.join(parts) ``` ```python def extract_pdf_text(path: Path) -> str: reader = PdfReader(str(path)) parts = [] for page in reader.pages: txt = page.extract_text() or '' txt = txt.strip() if txt: parts.append(txt) return '\n'.join(parts) ``` ```python for path in sorted(input_dir.iterdir()): if not path.is_file(): continue if path.suffix.lower() not in {'.docx', '.pdf'}: failures.append({ 'batch_id': batch_id, 'source_file': path.name, 'source_token': '', 'file_type': path.suffix.lower().lstrip('.'), 'failure_reason': 'out_of_scope', 'error_detail': 'v0.1 only supports .docx and .pdf', 'suggested_action': 'skip now or add parser in a later version', 'failed_at': utc_now(), }) continue try: successes.append(process_file(path, batch_id)) except Exception as e: failures.append({ 'batch_id': batch_id, 'source_file': path.name, 'source_token': '', 'file_type': path.suffix.lower().lstrip('.'), 'failure_reason': 'parse_error', 'error_detail': str(e), 'suggested_action': 'retry parsing or inspect the file manually', 'failed_at': utc_now(), }) ``` ### Technical Analysis The parsers open and traverse each accepted document without imposing limits on: - Compressed input size or decompressed DOCX archive size ...[truncated 1881 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unpinned parser dependencies create non-reproducible and unsafe installations
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code saves processed document metadata and summaries to kb-items.jsonl, failed-items.jsonl, ingest-report.md, and MEMORY.candidate.md. Although the script prints a final status message, it does not disclose before or during processing that document-derived content and error details will be written to disk, which is relevant because the inputs are user documents that may contain sensitive information.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The dependency python-docx is unpinned, which makes builds non-reproducible and can cause the environment to resolve to different versions over time, including versions with known security issues. In this file, the risk is heightened because python-docx has known advisories and there is no version constraint to verify whether a safe release will be installed.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
python-docx pypdf

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: python-docx has known advisories, including XXE-related issues in older releases, but the manifest does not specify a version, so it is impossible to determine whether deployment will use a fixed or vulnerable release. If an affected version is installed and the skill processes attacker-controlled DOCX files, this could enable XML external entity attacks or related parser abuse.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency pypdf is unpinned, so installations may resolve to different versions across environments or over time, including versions affected by published vulnerabilities. This is more concerning here because pypdf has numerous advisories, some involving denial-of-service conditions such as excessive runtime, memory usage, or infinite loops when processing crafted PDFs.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
python-docx pypdf

Unverifiable Dependency: pypdf has 16 known advisory(ies) (CVE-2026-84310 (pypdf: Possible long runtimes/large memory usage when retrieving outlines); CVE-2026-48156 (pypdf: Possible long runtimes for zero-only width values in cross-reference stre); CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: pypdf has multiple known advisories, and because the dependency is unpinned, the environment could install a vulnerable version without visibility or control. In a skill that may parse untrusted PDF input, this can expose the system to denial-of-service issues such as infinite loops, extreme CPU consumption, or excessive memory use triggered by crafted files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The content-type detector returns Chinese labels such as '制度', '流程', and '其他' regardless of user preference or document locale. This imposes a specific language output convention without opt-in, which can violate language or locale policy requirements for neutral or user-selectable output.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.