Security audit

pdf

Security checks across malware telemetry and agentic risk

Overview

This is labeled as a PDF skill but bundles broad database, scraping, media-generation, notification, reminder, and Discord voice capabilities that go well beyond normal PDF handling.

Install only if you intentionally want a broad multi-tool bundle, not just PDF handling. Review and limit any credentials before use, especially Supabase service-role keys, Discord bot tokens, and SkillBoss/API keys; avoid running the database, ComfyUI setup, downloader, scraping, or Discord voice components unless you explicitly need them and understand the local and external data flows.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (105)

Tainted flow: 'video_resp' from requests.get (line 127, network input) → pathlib.Path.write_bytes (file write)

Medium

Category: Data Flow
Content: print(f"Downloading video from {video_url}...") video_resp = requests.get(video_url, timeout=120) video_resp.raise_for_status() output_path.write_bytes(video_resp.content) # Verify and report if output_path.exists():
Confidence: 89% confidence
Finding: output_path.write_bytes(video_resp.content)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares only benign PDF-oriented behavior, yet static analysis detected effective capabilities equivalent to environment access, file read/write, network, and shell without any explicit permission declaration. This creates a serious transparency and governance gap: the agent may invoke powerful operations users and platform policy do not expect, increasing the risk of data exfiltration, unauthorized file manipulation, or command execution through a deceptively simple skill surface.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose is narrow and PDF-focused, but the detected behavior spans unrelated high-risk operations including database mutation, external service access, model downloads, video generation, scraping, and voice/agent routing. Such a large description-behavior mismatch is dangerous because it can mask hidden functionality behind a trusted PDF label, enabling unauthorized data access, remote calls, and cross-domain actions far beyond user intent.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: This script exposes broad Supabase database administration capabilities including raw SQL, mutation operations, RPC invocation, and schema inspection, which are unrelated to a PDF-processing skill's declared purpose. In a mismatched skill context, this creates unnecessary privileged access and expands the attack surface for unauthorized data access or modification.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The query path permits execution of arbitrary SQL through an RPC function and also allows arbitrary RPC calls elsewhere in the script, enabling unrestricted database reads, writes, and potentially destructive administrative actions depending on backend configuration. Because the skill is supposed to handle PDFs, this capability is unjustified and especially suspicious: it gives a PDF-facing workflow a covert path to operate on backend data stores.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script supports insert, update, upsert, and delete against arbitrary tables using a high-privilege Supabase service key, which enables unauthorized data tampering or destruction if the skill is invoked improperly. These mutation capabilities are not justified by the advertised PDF functionality and materially increase the risk of abuse.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The vector-search implementation transmits user-provided query text to an external embedding service and then uses the result to query Supabase RPC endpoints, adding outbound network exfiltration and backend search capabilities unrelated to the PDF skill description. In this context, the hidden external dependency and data flow are dangerous because user input may contain sensitive document content or queries.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is framed as a local ComfyUI runner, but its documented behavior expands into installation, server management, and model acquisition. That broadens the trust boundary from using an existing local tool to making persistent system changes and fetching external content, increasing the chance of unsafe execution paths and user-surprising side effects.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documentation authorizes downloading arbitrary files from user-provided URLs into the local ComfyUI models tree and even auto-installs a helper downloader binary if missing. This creates a supply-chain risk and enables untrusted remote content and executable tooling to be introduced onto the host without strong validation, provenance checks, or explicit consent.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill instructs the agent to clone a remote repository, create a virtual environment, install dependencies, and start a server whenever ComfyUI is unavailable. That is effectively unattended software installation and execution from the network, which is dangerous in an agent context because it can modify the host and run unreviewed code.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file defines a full image-generation pipeline using diffusion, CLIP, VAE, and image saving components, which is unrelated to the skill's declared PDF-processing purpose. This capability expansion is dangerous because it introduces hidden behavior outside user expectations and can be used to generate policy-violating or deceptive content under the cover of a benign PDF skill.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The embedded prompt explicitly requests a nude full-body portrait, which is unjustified in a PDF-focused skill and indicates intentional inclusion of sexual image-generation behavior. In this context, the mismatch makes the content more dangerous because it suggests concealed functionality for generating sensitive or policy-violating material rather than an accidental leftover test asset.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: This code submits arbitrary workflows to a network-accessible ComfyUI server and polls for results, which is unrelated to the declared PDF-processing purpose of the skill. Hidden or undocumented networked job-execution capability increases the risk of misuse, unauthorized service interaction, and deceptive behavior within a skill users would reasonably expect to only handle PDFs.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The entire script is dedicated to executing ComfyUI image-generation workflows over HTTP, not PDF operations described in the skill metadata. This capability mismatch is dangerous because it conceals materially different behavior from users and reviewers, making it easier to smuggle in unexpected network access and remote task execution under the guise of a benign PDF tool.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script downloads an executable from the internet into `~/.local/bin`, marks it executable, and later runs it, effectively introducing remote code execution through an unpinned, unverified supply-chain dependency. In the context of a PDF skill, this behavior is especially suspicious because installing and executing a model-download helper is unrelated to the declared purpose, increasing the likelihood of harmful or unauthorized system modification.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file's functionality is to download model weights into ComfyUI model directories, which is materially unrelated to the skill's stated PDF-processing purpose. Capability mismatches like this are dangerous because they can hide unexpected behaviors from users and reviewers, and here the hidden behavior includes writing files and fetching external artifacts.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill documentation materially expands from advisory notification guidance into executable instructions for outbound email delivery through a third-party API. That creates a real capability for external data transmission from within a skill document, which is risky because agents may copy the example and send user data or operational content off-platform without separate trust review or consent controls.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The file is being evaluated under PDF skill metadata, but the content is a notification skill that includes credential access and remote email delivery. That mismatch makes the capability especially dangerous because operators may approve or invoke it under an unrelated trust boundary, enabling secret use and outbound communication that are not justified by the declared context.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill claims legal/robots.txt-compliant scraping, but later recommends a managed scraping service with automatic anti-bot handling. That creates a contradictory control story and can normalize bypassing site defenses, increasing the chance an agent uses third-party infrastructure to access content in ways the earlier policy says should be avoided.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This file belongs to a PDF skill, but it embeds scraping and remote LLM analysis workflows that are unrelated to local PDF processing. In a skill system, this scope mismatch is dangerous because it enables unexpected network access and external data transmission under the guise of a benign PDF capability, increasing the chance of covert exfiltration or unauthorized web activity.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code implements robots.txt-aware web scraping, session setup, and rate-limited fetching, none of which are justified by the stated purpose of a PDF skill. The danger is not that scraping exists in isolation, but that hidden, unnecessary network behavior expands the attack surface and can be abused to access arbitrary URLs or process remote content without clear user intent.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: This section introduces external API usage, secret handling via environment variables, and transmission of scraped page data to a third-party chat service, all outside the expected scope of a PDF skill. That combination materially increases risk because sensitive user or document-derived content could be sent off-platform to external services without transparent consent or necessity.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This script performs a remote search against an external API, but the declared skill purpose is PDF handling. That mismatch is security-relevant because user-provided queries and potentially sensitive context may be transmitted to a third party under functionality the user would not reasonably expect from a PDF skill.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script requires an external API key and prepares to send user-supplied input to a remote service, which is not justified by the stated PDF-processing purpose. In a mismatched skill, this expands the trust boundary and creates risk of unexpected data disclosure or hidden external dependency.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This script performs arbitrary URL scraping through a third-party API, which is materially broader than the stated purpose of a PDF skill. That capability can exfiltrate user-provided URLs and enable off-scope network access or data collection, making the mismatch between declared functionality and actual behavior especially risky in an agent skill context.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: voice/index.ts:156

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: voice/src/streaming-tts.ts:45

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: voice/src/stt.ts:37

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: voice/src/tts.ts:48

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: voice/src/config.ts:269

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: voice/src/streaming-tts.ts:110

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: voice/src/tts.ts:96

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: voice/index.ts:158