Security checks for vulnerabilities and agentic risk
Overview
This PDF tool mostly matches its stated purpose, but it has real unsafe export and file-handling issues that users should review before installing.
Review before installing. Use this only on PDFs you are authorized to process, avoid running the example script in directories with important files, do not open generated HTML or spreadsheet files from untrusted PDFs without sanitizing them first, and do not rely on the current permission-restriction API to enforce PDF copy/print limits.
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
Location
src/pdf_intelligence_suite/tables.py:126
Finding
Spreadsheet Formula Injection in CSV and Excel Exports
Content
View full analysis
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
Location
src/pdf_intelligence_suite/converter.py:259
Finding
Stored HTML Injection in PDF-to-HTML Conversion
Content
View full analysis
PDF Export
body {{
font-family: Arial, sans-serif;
max-width: 800px;
margin: 0 auto;
padding: 20px;
line-height: 1.6;
}}
pre {{
white-space: pre-wrap;
word-wrap: break-word;
}}
text
{text}
"""
with open(output_path, 'w', encoding='utf-8') as f:
f.write(html_content)
```
### Technical Analysis
Text extracted from the source PDF is interpolated directly into an HTML document without HTML entity encoding. The surrounding `text
` element does not provide an escaping boundary. Attacker-controlled text containing markup such as a closing `
` tag can terminate the intended text container and inject arbitrary HTML elements, event handlers, or scripts.
This is a stored injection because the malicious content is persisted in the generated HTML output and activates when that file is rendered.
### Attack Path
1. An attacker creates a PDF whose extractable text contains HTML syntax, such as a closing `` tag followed by an active HTML element.
2. A victim calls `PDFConverter.to_html()` on the attacker-controlled PDF.
3. The extracted payload is inserted unchanged into the generated HTML file.
4. The victim opens the file in a browser or publishes it on a web server.
5. The browser interprets the injected content as markup rather than text.
6. Injected JavaScript or event handlers execute under the generated document's browser origin and applicable browser restrictions.
### Impact Assessment
If the generat
...[truncated 630 chars]
Remediation
View remediation
` element.
3. Add a restrictive Content Security Policy, for example one that denies scripts, plugins, frames, and remote connections.
4. Avoid accepting raw markup unless an explicit trusted-HTML mode is provided.
5. If formatting support is required, use a well-maintained allowlist sanitizer rather than string substitution.
6. Add regression tests containing closing tags, `
T09 · Insecure Skill Coding Practices
Warning
Location
examples/basic_usage.py:145
Finding
Executable Example Can Overwrite and Delete Pre-existing User Files
Content
View full analysis
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
Location
src/pdf_intelligence_suite/security.py:64
Finding
Requested PDF Permission Restrictions Are Calculated but Never Applied
The broader mismatch suggests the skill may perform undeclared page manipulation, security changes, and conversions to formats different from those promised, while declared core capabilities are not evidenced. In security terms, this is a trust-boundary problem: the user is induced to approve a tool under one mental model while actual behavior may be substantially different and more invasive.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The broader mismatch suggests the skill may perform undeclared page manipulation, security changes, and conversions to formats different from those promised, while declared core capabilities are not evidenced. In security terms, this is a trust-boundary problem: the user is induced to approve a tool under one mental model while actual behavior may be substantially different and more invasive.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The broader mismatch suggests the skill may perform undeclared page manipulation, security changes, and conversions to formats different from those promised, while declared core capabilities are not evidenced. In security terms, this is a trust-boundary problem: the user is induced to approve a tool under one mental model while actual behavior may be substantially different and more invasive.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The broader mismatch suggests the skill may perform undeclared page manipulation, security changes, and conversions to formats different from those promised, while declared core capabilities are not evidenced. In security terms, this is a trust-boundary problem: the user is induced to approve a tool under one mental model while actual behavior may be substantially different and more invasive.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The broader mismatch suggests the skill may perform undeclared page manipulation, security changes, and conversions to formats different from those promised, while declared core capabilities are not evidenced. In security terms, this is a trust-boundary problem: the user is induced to approve a tool under one mental model while actual behavior may be substantially different and more invasive.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content
Scanner excerpt · README.md (reported line 33)May include surrounding context.
This markdown file documents security-sensitive operations such as decrypting PDFs and modifying protected documents, but it provides no user warning about confidentiality risks, password handling, or the need to ensure authorization before removing protection. It also omits any caution that page-removal and related manipulation operations can alter document contents in ways that may affect data integrity.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content
Scanner excerpt · README.md (reported line 309)May include surrounding context.
The skill advertises capabilities that inherently read from and write to local files, but it does not declare any explicit tool scope or permissions. This creates an authorization and review gap: users and automated policy systems cannot easily tell that the skill may access or modify files, which increases the chance of unintended document exposure or modification.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The skill describes page operations and metadata management but omits warnings that these actions can permanently modify, remove, or expose document content and metadata. In a PDF-processing context this is meaningful because users may assume non-destructive analysis, while the skill can affect document integrity, confidentiality, and auditability.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The manifest describes the skill as a PDF processing suite for text extraction, table recognition, OCR, and PDF-to-Word/Excel conversion. This file also showcases page-manipulation features such as merge, split, rotate, delete, reorder, and extraction, plus encryption/decryption and watermarking, which are materially broader capabilities than the manifest advertises.
Content
No source excerpt is available for this finding.
Unbounded Output
Medium
Category
Output Handling
Confidence
75% confidence
Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
Content
Scanner excerpt · src/pdf_intelligence_suite/converter.py (reported line 141)May include surrounding context.
python
# 调整列宽
for col in ws.columns:
max_length = 0
column = col[0].column_letter
for cell in col:
try:
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The HTML export embeds extracted PDF text directly inside a
text
element without escaping HTML special characters. If a PDF contains attacker-controlled text such as
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
The manifest describes a PDF intelligence suite focused on text extraction, table recognition, OCR, and PDF-to-Word/Excel conversion. This module instead implements broad PDF page editing operations such as merge, split, rotate, delete, insert, reorder, and duplicate, which are materially different document-manipulation capabilities rather than the stated extraction/recognition/conversion functions.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
This code file contains natural-language docstrings and messages exclusively in Chinese, including the module description and later exception text. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding
This code reads a user-supplied PDF, converts its pages to images, and extracts full text content, which can include sensitive personal or business data. While the function has technical docstrings, there is no user-facing warning, confirmation, or disclosure about processing document contents or the privacy implications of OCR.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding
The function extracts not only recognized text but also confidence scores and bounding-box metadata for each token, increasing the sensitivity of the produced output. There is no visible warning, logging, or user disclosure indicating that detailed document content and layout information will be extracted and returned.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The decrypt method removes PDF encryption and writes the resulting plaintext document to output_path, which is a safety-relevant file write affecting document confidentiality. Although the function has a docstring, there is no explicit user-facing warning, confirmation, or disclosure that a protected document will be saved in decrypted form.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The natural-language content in the module and method docstrings is exclusively Chinese, with no indication that users may choose another language. Under the policy provided, forcing a specific language without opt-in is a natural-language policy violation.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
96% confidence
Finding
The natural-language skill documentation appears to force a specific language for all user-facing instructions and examples. Under the stated policy, this is a locale/language constraint unless the skill offers user choice or clearly documents why the restriction is necessary.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
85% confidence
Finding
This code file includes natural-language strings and documentation that assume a specific language/locale presentation, primarily Chinese, with bilingual support added but no user-selectable locale behavior. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy issue.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
84% confidence
Finding
The file includes a Chinese-only descriptive comment alongside the English title, and multiple subsequent section headers are written only in Chinese. For a general-purpose skill artifact, this suggests a language preference is being imposed without any stated opt-in or locale-specific justification, which can conflict with language/locale policy expectations.
Content
No source excerpt is available for this finding.
Unpinned Dependencies
Low
Category
Supply Chain
Confidence
89% confidence
Finding
Using a lower-bound specifier like ">=" for PyPDF2 makes builds non-reproducible and can silently resolve to vulnerable or breaking versions over time. In a PDF-processing skill that handles untrusted documents, dependency drift is more dangerous because parser vulnerabilities are a common attack surface.
Content
Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.
