SKILLS

• Outcome: Review
• Latest audit: Sep 15, 2026 · 3:53 AM UTC
• Version: 2.0.0

Overview

This document-conversion skill warrants Review because it exposes broad local file reading and uploads selected documents to a third-party conversion API.

Install only if you are comfortable running a globally installed third-party npm package and sending chosen files to ofd365.com. Avoid sensitive, regulated, credential-bearing, or private files unless your policy allows it, and do not expose SSE mode beyond a trusted local environment without strong access controls.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash

npm install -g dianju-ofd-tools

Technical Analysis

The installation instructions retrieve the latest available version of dianju-ofd-tools rather than an exact, reviewed version. The package source and lockfile are not included in the audited project, so its implementation, transitive dependencies, and npm lifecycle scripts could not be verified.

A global npm installation may execute package lifecycle scripts with the privileges of the user running npm. Because the version is not pinned, the effective code installed by this instruction can change after this audit without any modification to SKILL.md. A compromised package release, maintainer account, registry response, or transitive dependency could consequently introduce arbitrary code.

Attack Path

1. An attacker compromises the npm package, a package maintainer, or one of its transitive dependencies.
2. The attacker publishes a malicious release under the existing package name.
3. A user follows the documented npm install -g dianju-ofd-tools instruction.
4. npm resolves the unpinned dependency to the malicious release.
5. Malicious lifecycle code executes during installation, or malicious application code executes when the installed CLI or MCP service starts.
6. The payload operates with the installing or service-running user's permissions.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the current user's account. Depending on that user's permissions, an attacker could access local files and credentials, alter user-owned programs or configuration, intercept documents and API keys processed by the tool, or establish additional persistence. Global installation also makes the affected executable available outside the proj ...[truncated 40 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to an exact version that has undergone security review, for example dianju-ofd-tools@2.0.0, rather than accepting the latest release.
• Publish and verify package integrity information, such as a trusted registry integrity hash or signed release artifact.
• Include the implementation and dependency lockfile in the audited project so package behavior and transitive dependencies can be reviewed.
• Use a trusted, explicitly configured npm registry and enable dependency provenance verification where supported.
• Install the package in an isolated, least-privileged environment rather than globally.
• Disable npm lifecycle scripts with --ignore-scripts where they are not required, after confirming that this does not prevent legitimate operation.
• Continuously scan pinned direct and transitive dependencies and require review before upgrading them.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:72

Finding

Arbitrary Local File Disclosure Through the Base64 File-Read Tool

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 72–80
Vulnerability Type: Unrestricted local-file access exposed through an MCP tool
Risk Level: High

Vulnerable Code

markdown

### 5. File to Base64

- **Tool Name:** `read_file_as_base64`
- **Description:** Read a local file and return its Base64-encoded content. No API call required (local operation).
- **Parameters:**
  ```json
  { "filePath": "string" }
  ```
- **Returns:** Base64-encoded string of the file content

The documentation further states that absolute paths may be used for files outside the current directory.

Technical Analysis

The tool exposes a generic local-file read primitive controlled by the caller through filePath. The documented interface does not specify a workspace allowlist, canonical-path validation, sensitive-path denylist, file-type restriction, symlink protection, or per-request user approval.

Base64 encoding does not protect confidentiality; it is reversible representation rather than encryption. Any client capable of invoking this MCP tool could request a sensitive path and receive its contents as Base64. An agent affected by prompt injection could also be induced to invoke this capability without the user's informed intent.

The available project contains documentation only, so implementation-level safeguards cannot be verified. The documented contract itself nevertheless authorizes arbitrary paths and explicitly supports files outside the current directory.

Attack Path

1. An attacker supplies a malicious instruction through content processed by an MCP-connected agent, or directly controls a client authorized to invoke the tool.
2. The attacker requests read_file_as_base64 with an absolute path to a sensitive file accessible to the MCP process, such as an environment file, SSH private key, cloud credential file, API configuration, or MCP client configuration.
3. The server opens the req ...[truncated 1302 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the generic file-read tool unless unrestricted local file access is essential to the Skill's purpose.
• Restrict access to explicitly configured workspace roots and default to denying every path outside those roots.
• Resolve the requested path with the platform's canonical-path operation before authorization checks.
• Verify that the canonical target remains inside an approved root and reject .. traversal, alternate path encodings, device paths, and symlink or junction escapes.
• Deny known sensitive files and directories, including SSH keys, cloud credential stores, .env files, browser profiles, operating-system credential locations, and MCP configuration containing secrets.
• Require explicit, informed user approval for every read, displaying the canonical path and expected destination of the returned data.
• Run the MCP service under a dedicated, least-privileged account with access only to the required conversion workspace.
• Apply file-size and file-type limits to reduce unintended disclosure and resource exhaustion.
• Authenticate and authorize every SSE client, bind to localhost by default, and do not expose the service publicly without transport security and access controls.
• Record security audit events without logging file contents or secrets.
• Add tests covering absolute paths, traversal attempts, symlinks, junctions, case variations, and sensitive-file denial.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill processes local files by Base64-encoding them and sending their contents to the remote ofd365.com API for conversion, but the description and feature sections do not prominently warn users that document contents leave the local environment. This can mislead users into submitting sensitive documents under the assumption the tool is primarily local, creating confidentiality and compliance risks when used with private, regulated, or proprietary files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.