Ppx Parse

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:10 AM UTC
• Version: 1.0.0

Overview

This skill coherently helps parse PDFs and images with a local PPX tool, with ordinary but real privacy and dependency-installation cautions.

Install PPX in a dedicated virtual environment, parse only documents you intend to expose to the workspace, choose a specific output directory, clean generated outputs when they contain sensitive content, and prefer trusted or pinned package sources for installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/troubleshooting.md:17

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: references/troubleshooting.md, lines 17–20, 29–31, and 37
Vulnerability Type: Unpinned dependencies installed from the active package index
Risk Level: Medium

Vulnerable Code

bash

python -m pip install --upgrade pip
pip install memect-ppx
pip install onnxruntime
pip install opencv-contrib-python

bash

source .venv/bin/activate
pip install memect-ppx
pip install onnxruntime
pip install opencv-contrib-python

bash

pip install opencv-python-headless

Technical Analysis

The troubleshooting instructions install several third-party Python packages without version constraints, cryptographic hashes, a lock file, or an explicitly trusted package index. They also upgrade pip without pinning a reviewed version.

Consequently, installation results can change over time and depend on the active pip configuration and package index. If an upstream release, package account, configured mirror, or dependency is compromised, pip may download and install attacker-controlled code. Python package installation can execute package-controlled build logic, and installed code executes when PPX or its dependencies are imported or invoked.

This is a supply-chain weakness rather than evidence that the currently named packages are malicious.

Attack Path

1. A user follows the documented recovery procedure because ppx is unavailable.
2. The user creates or activates a virtual environment and runs the listed unpinned pip commands.
3. Pip resolves packages and transitive dependencies using the environment's configured index without checking project-supplied hashes.
4. A compromised upstream package, malicious release, dependency-confusion candidate, or untrusted mirror supplies attacker-controlled package content.
5. Attacker-controlled code runs during package build or installation, or later when ppx imports and executes the installed component.

Impact Assessment

Successful exploitation can e ...[truncated 593 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed exact version, including installation tooling if it must be upgraded.

2. Generate a lock or requirements file containing hashes for all direct and transitive artifacts.

3. Install with hash enforcement, for example:

   bash

   python -m pip install --require-hashes -r requirements.lock
   

4. Explicitly use the official PyPI index or a controlled, authenticated internal mirror instead of inheriting an unknown pip configuration.

5. Review package provenance and dependency changes before updating pinned versions.

6. Prefer prebuilt, verified wheels and disable source builds where operationally practical.

7. Avoid upgrading pip implicitly as part of Skill setup. If an upgrade is required, pin and verify the approved version.

8. Keep installation inside a dedicated, least-privileged virtual environment and never recommend running these commands with sudo.

9. Consider documenting integrity verification and incident-response steps for compromised package releases or mirrors.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear mismatch between the description and the code. The declared purpose describes an OCR/document-parsing skill for PDFs and images. The actual code does not process user documents at all; it only reads pyproject.toml, extracts project.version, and rewrites the version line in SKILL.md. This is a build/release metadata synchronization utility, not a PDF/image parsing skill. The file access patterns (pyproject.toml and SKILL.md) and behavior are unrelated to the declared triggers and functionality.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill clearly directs the agent to read local input files and write parsed document contents to an output directory, but it does not declare any explicit tool scope or permissions boundary. That omission increases the chance of over-broad file access or unexpected writes by the agent runtime, especially when handling sensitive local documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs converting local PDFs and images into doc.md, doc.json, page files, and extracted images, but it does not prominently warn that potentially sensitive document contents will be persisted to disk. In environments processing private records, this can create unintended data exposure through residual files, broader workspace visibility, backups, or later agent access.

Content

No source excerpt is available for this finding.