Back to skill

Security audit

cn-pdf-report-typeset

Security checks for vulnerabilities and agentic risk

Overview

The skill mainly builds Chinese PDF reports locally, but it also directs agents to search prior work and automatically deliver/store reports through a Feishu and knowledge-base workflow.

Install only if you want this exact Chinese PDF workflow. Before use, disable or require confirmation for Feishu delivery, session-history search, and knowledge-base backup when handling confidential reports. Review output paths to avoid overwriting files.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description promises a deliverable-standard Chinese PDF solution with explicit layout standards, reusable templates, and an automatic typesetting self-check script. The code does partially align on Chinese PDF generation details: it uses ReportLab, registers Microsoft YaHei fonts, sets A4 portrait margins, includes a cover, footer with page numbers, and wraps table cells using Paragraph with CJK word wrapping. However, the actual script's primary behavior is to render one specific prewritten learning-note PDF, not to provide a general report-generation toolkit/template for arbitrary client reports. More importantly, several claimed standards are not met by the implementation itself: body text is set to 15pt rather than the declared ≥16pt, and some tables use 12–13pt rather than the declared ≥15pt. The description also explicitly advertises a self-check script that validates font sizes, page balance, and unnecessary pagination, but no such checking logic exists anywhere in the code chunk. These are material description-versus-behavior mismatches rather than minor implementation details.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code broadly matches the general theme of generating a Chinese PDF report locally with ReportLab and Microsoft YaHei, including cover, footer, page numbering, and a table template. However, several key advertised delivery-grade features are absent or contradicted by the implementation. The description strongly promises layout standards and an automated self-check script, but the code contains no post-generation validation at all. It also claims larger minimum font sizes for readability on phones, yet the body style is 15pt and tables use 13pt by default, below the stated thresholds. The table helper does not wrap long Chinese content using Paragraph objects as described; it just passes raw strings into a Table. Overall, the primary purpose is similar, but the implementation materially underdelivers on multiple specifically advertised capabilities, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
81% confidence
Finding

The skill explicitly instructs use of shell/Python execution and package installation, but it does not declare any tool scope or allowed-tools boundaries. In an agent environment, that creates unnecessary execution latitude and increases the chance the skill is invoked with broader command execution privileges than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Overly broad trigger phrases can cause the skill to activate for routine PDF-related requests that do not actually need this workflow. In an agent system with shell access and file-generation behavior, over-triggering increases the chance of unintended execution, unnecessary file handling, or application of this skill in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation conditions are broad enough to match common business phrases like '发PDF上来' or '结论做出来发我,' which may refer to simple document handling rather than this specific formatting skill. In context, that broad matching is more dangerous because the skill also contains execution and external-delivery instructions, so accidental invocation can lead to unintended processing or sharing of sensitive content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill expands from local PDF formatting into a mandatory Feishu delivery workflow, including instructions to send generated files into chat and store them in a knowledge base. That broadens the skill from local document rendering into data handling and transmission, creating a higher risk of unintended disclosure of sensitive report contents if the agent follows these instructions automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

该 markdown 文件以中文撰写,并在开头明确规定“所有 PDF 报告必须用此字号”,但未说明该标准仅适用于中文报告或特定中文受众场景。按文件文字表述,这会将中文排版规范默认施加到所有 PDF 报告,缺少用户语言/区域选择,构成潜在的语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring explicitly states the output is a professional Chinese PDF, which imposes a specific language choice. There is no indication that the user can select another language or that the locale restriction is required for a documented region-specific purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest advertises a directly runnable template plus a layout self-check script, including validation of font sizes, extra page breaks, and page balance. In this file, the docstring mentions verification with pymupdf, but the code only builds a PDF and prints its size; it performs no self-checking, no font-size audit, no page-balance inspection, and no redundant page-break detection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring states the template is a Chinese professional PDF report template and instructs direct use, while the content and output strings throughout the file are fixed in Chinese. This imposes a specific language/locale by default without any opt-in, choice mechanism, or documented justification that the skill is intended only for a China-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The instruction says all PDFs must use a gold-toned palette and forbids blue, making a blanket stylistic requirement without offering user opt-in or alternative preferences. This is a natural-language policy issue because it forces a presentation choice universally rather than allowing the user to choose or documenting a justified constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file includes the author's WeChat contact, public account, external storefront URL, and a remote QR-code image link. These capabilities and references are not justified by the stated purpose of a local Chinese PDF report typesetting skill and introduce unrelated external-touchpoint behavior into the skill package.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

Line L25 explicitly frames the example usage as producing a Chinese PDF, which imposes a language/locale expectation in natural language. The file does not indicate that this is optional, user-selected, or required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code creates and writes a PDF to the path in OUT via BaseDocTemplate, which is a file-writing operation. Although the output path is configurable in a comment, there is no runtime confirmation prompt or user-facing warning that an existing file may be overwritten.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring states that validation is done by opening the output with pymupdf and checking page count, Chinese text, and the final-page conclusion. However, the actual code never imports pymupdf or executes any validation logic; it only generates the PDF and prints output metadata.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.