Security audit

academic-pdf-redaction

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but its PDF anonymization recipe can falsely report success while leaving identifying information behind.

Review before installing or relying on this skill for blind review. It is suitable as a rough starting point for manual PDF redaction, but users should not treat its verification as proof of anonymization; they should manually inspect visible text, PDF properties, annotations, attachments, and any generated output path before sharing the result.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:58
Finding: Premature References Detection Can Bypass Redaction
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:82
Finding: Verification Can Accept Failed or Incomplete Redaction
Content: View full analysis
{len(redc)}") if redc_len < 1000: raise ValueError(f"PDF corrupted: only {redc_len} chars remain!") if redc_len < orig_len * 0.7: raise ValueError(f"Too much removed: kept only {redc_len/orig_len:.0%}") orig.close() redc.close() print("✓ Verification passed") ``` ### Technical Analysis The verification routine checks page count, a minimum extracted-text length, and an aggregate text-retention ratio. It does not verify that any requested sensitive value was found or removed. A complete no-op therefore retains 100% of the text and passes every check. The code also allows 70% retention, while the skill's critical rules state that at least 80% of the original text must remain. In addition, `redc_len/orig_len` can raise a division-by-zero error for PDFs with no extractable text. ### Attack Path 1. Exact searching fails because the PDF uses split glyphs, alternate encoding, OCR images, or a different textual representation. 2. Alternatively, premature References detection causes pages to be skipped. 3. Sensitive values remain present in the saved output. 4. Page count remains unchanged and most or all extracted text remains. 5. The ...[truncated 430 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:52
Finding: PDF Metadata and Embedded Structures Are Not Sanitized
Content: View full analysis
= references_page: continue # Skip References section for pattern in patterns: # ONLY redact exact search matches for rect in page.search_for(pattern): page.add_redact_annot(rect, fill=(0, 0, 0)) page.apply_redactions() os.makedirs(os.path.dirname(output_path), exist_ok=True) doc.save(output_path) doc.close() # MUST verify after saving verify_redaction(input_path, output_path) ``` ### Technical Analysis The workflow modifies visible page content but does not inspect or clear document metadata or other embedded PDF structures. Potential sources of identifying information include standard metadata fields, XMP metadata, annotations, form fields, attachments, embedded files, comments, and links. The verification routine only measures extracted page text. It cannot detect author names or institutional details stored in document properties or non-page-content objects. ### Attack Path 1. The source PDF contains an author name, organization, email address, or document history in metadata or an embedded structure. 2. The workflow redacts matching visible page text. 3. The document is saved without an explicit metadata and embedded-content s ...[truncated 515 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:35
Finding: Documented Wildcard Patterns Are Treated as Literal Search Strings
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This is a markdown file, so SQP-2 applies to whether the skill description warns about behaviours that could affect user data or system integrity. The example performs filesystem changes via directory creation and saving a new PDF, but the surrounding documentation does not explicitly warn users about these write operations or advise choosing a safe output path.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.