Security audit

Fill XFA PDF Forms

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for filling XFA PDFs, but it can expose sensitive form contents by printing filled values to logs by default.

Review or patch the script before using it with real forms: remove default value printing or run it only where terminal output is not captured. Use an explicit output file, keep an untouched copy of the source PDF, validate the filled PDF before submission, and install pikepdf in an isolated environment with pinned versions if possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:18
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fill_xfa.py:244
Finding: Sensitive XFA Form Values Disclosed Through Standard Output
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description lists triggers such as "filling PDF forms" and "PDF befüllen," which are broad natural-language phrases that could overlap with ordinary requests beyond XFA-specific use. Although the description mentions XFA context, it does not clearly distinguish when the skill should activate versus when standard PDF form-filling requests should not invoke it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The markdown explains that the script modifies embedded XFA XML directly and later writes output files, but it does not include a clear warning that the operation alters document contents and should be used on copies or reviewed carefully. For a file-manipulating skill, a short user-facing caution would better disclose the impact on user data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.