Memect Ppx

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:03 AM UTC
• Version: 0.2.6

Overview

This skill is a straightforward document OCR/parsing helper with some normal setup and maintenance commands, but users should be careful with dependency installs and backend settings.

Install this skill only if you are comfortable running `ppx` locally on the documents you provide. Prefer a dedicated virtual environment, review or pin package versions before installing in sensitive environments, and avoid LLM/backend options for confidential documents unless you control the configured endpoint.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/troubleshooting.md:20

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: references/troubleshooting.md, lines 20–25, 34–44
Vulnerability Type: Supply-chain exposure caused by unpinned dependencies
Risk Level: Medium

Vulnerable Code

bash

python3.12 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
pip install memect-ppx
pip install onnxruntime
pip install opencv-contrib-python

bash

source .venv/bin/activate
pip install memect-ppx
pip install onnxruntime
pip install opencv-contrib-python

bash

pip install opencv-python-headless

Technical Analysis

The documented setup procedure installs third-party packages without fixed versions, cryptographic hashes, a lockfile, or an explicitly trusted package index. Consequently, the dependency set resolved by pip can change after the Skill has been audited.

A virtual environment limits dependency conflicts with the system Python installation, but it does not establish package authenticity or prevent installed code from accessing resources available to the invoking user. Installing the latest available release also permits a compromised or unexpectedly changed upstream package to enter the execution environment without further review.

The same concern applies to upgrading pip without a version or hash constraint. The audit found no evidence that the named packages are currently malicious; the vulnerability is the unsafe, non-reproducible dependency installation process.

Attack Path

1. An attacker compromises a named package, a package publisher account, or the configured Python package repository.
2. The attacker publishes a malicious release under one of the dependency names used by the setup instructions.
3. The local ppx executable is unavailable, causing an operator or agent to follow the troubleshooting workflow.
4. pip resolves the unconstrained package name to the attacker-controlled release.
5. The malicious package executes code during installation or when the i ...[truncated 789 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed version rather than installing unconstrained package names.
2. Maintain dependencies in a lockfile or requirements file containing cryptographic hashes.
3. Install with hash verification, for example:

bash

python -m pip install --require-hashes -r requirements.txt

4. Pin the installer version instead of using an unconstrained pip install --upgrade pip.
5. Explicitly configure an approved package index and disallow untrusted extra indexes.
6. Review and update pinned versions through a controlled dependency-update process with security scanning and regression testing.
7. Perform installation as an unprivileged user inside an isolated virtual environment or container.
8. Where practical, distribute and verify signed release artifacts or prebuilt packages from a controlled internal repository.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose centers on PDF/image OCR and parsing through a CLI tool, but the actual code does none of that. Instead, it accesses local repository files (pyproject.toml and SKILL.md), reads the project version, and rewrites the skill manifest/version line. This is a materially different primary purpose and an undeclared file-modification capability unrelated to the stated parsing/OCR functionality.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad phrases such as document parsing, OCR, image text recognition, and table extraction in multiple languages, which can cause the skill to activate in routine conversations where the user did not explicitly request this specific tool. Over-broad activation increases the chance of unnecessary file access, command execution, or installation steps in contexts where a safer or more specific workflow should have been used.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.