Dxf Text Extractor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:02 AM UTC
• Version: 1.0.0

Overview

The skill appears to do DXF text extraction, but it tells the agent to silently install an unpinned Python dependency at runtime, which users should review before installing.

Review this skill before installing. It is purpose-aligned for DXF text extraction, but it should not silently install dependencies during normal use; prefer a pinned, preinstalled `ezdxf` dependency in an isolated environment, and only run it on DXF files you intentionally provide.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Silent Installation of an Unpinned Runtime Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 18
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet

markdown

在运行脚本前，确认后台环境中已正确安装 `ezdxf` Python 依赖库。如未安装，请静默执行 `pip install ezdxf`。

English translation:

text

Before running the script, confirm that the ezdxf Python dependency is installed. If it is not installed, silently execute `pip install ezdxf`.

Technical Analysis

The Skill instructs the agent to install ezdxf directly from the package index at runtime without specifying an audited version, validating package hashes, using a lockfile, or requesting explicit user approval.

Because pip install ezdxf resolves the package and its transitive dependencies at execution time, the code ultimately installed may differ from the code available when the Skill was reviewed. A compromised package release, package-maintainer account, package index, or transitive dependency could introduce malicious installation or runtime behavior.

The package name is consistent with the module imported by scripts/extract_text.py, and no untrusted custom package index or intentionally deceptive package name was identified. Therefore, this is an unsafe dependency-management practice rather than evidence that the current package is malicious.

Attack Path

1. A user invokes the Skill to process a DXF file.
2. The agent checks the environment and determines that ezdxf is unavailable.
3. Following SKILL.md line 18, the agent silently executes:

   bash

   pip install ezdxf
   

4. Pip retrieves the current package version and any transitive dependencies from its configured package index.
5. If a retrieved release, dependency, maintainer account, or index is compromised, malicious installation hooks or imported runtime code execute under the agent process's operating-system identity.
6. The malicious dependency could access resources available to that identity before or ...[truncated 608 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove silent dependency installation from task-time Skill instructions.
2. Pin ezdxf and every transitive dependency to reviewed versions in a dependency or lock file.
3. Require package hashes, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Install dependencies during a controlled deployment or setup phase rather than when processing user files.
5. Use an isolated virtual environment or container with least-privilege permissions.
6. Restrict installation to an approved package index or internal artifact repository.
7. Require explicit user or administrator approval before modifying the environment.
8. Run dependency vulnerability and provenance checks as part of the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A description-behavior mismatch is dangerous because reviewers and users may trust the declared purpose while the actual implementation does something materially different. In this case, the skill claims CAD/DXF extraction but static analysis indicates the implementation does not perform that function, which can conceal unintended code paths, mislead operators, and bypass scrutiny that would apply to the real behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill appears to require file read/write behavior and script execution but does not declare an explicit tool scope or permissions boundary. That creates unnecessary ambiguity about what filesystem access the agent may use, increasing the risk of overbroad file access or modification when handling user-supplied CAD files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Overly broad trigger phrases can cause the skill to activate in contexts beyond narrow DXF text extraction, exposing file-handling and script-execution behavior when a user only asked a general question about CAD or structure drawings. That expands the attack surface and increases the chance of unnecessary access to uploaded files or accidental execution in the wrong workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Directing the agent to install a package at runtime via pip introduces supply-chain and environment-integrity risk, especially when done automatically from skill instructions. Even if ezdxf is plausibly related to DXF parsing, installing dependencies during execution can pull unpinned code, change the host environment, and create a path for malicious package substitution or breakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Silent package installation removes user awareness and approval for a security-relevant action that modifies the runtime environment. In a skill that processes user-supplied files, undisclosed installation behavior is especially risky because it can mask network access, dependency tampering, or persistence changes that are unrelated to the immediate user request.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes extracting and cleaning text from DXF files, which implies read/parse behavior. This code additionally generates and writes a new Markdown file to disk containing a formatted report, which is a persistent side effect not stated in the manifest description.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest says the skill is triggered when a user uploads a DXF file or asks to extract text from one, implying operation on user-provided input. In contrast, the script will enumerate local .dxf files in the current directory and process the first one automatically, which broadens behavior beyond the described input model.

Content

No source excerpt is available for this finding.