Nested PDF Merger

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:35 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward wrapper for a PDF-merging CLI, with the main caveat that it recommends an unpinned pip install.

Install the dependency only from a package source you trust, preferably in a virtual environment, and consider pinning a reviewed `nestedpdfmerger` version before using it on sensitive PDFs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–21 and line 43
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

Lines 19–21:

markdown

Expected installation command:

```bash
pip install nestedpdfmerger

text

Line 43:

```markdown
4. If the command fails because the binary is missing, tell the user to install it with `pip install nestedpdfmerger`.

Technical Analysis

The skill recommends installing nestedpdfmerger from the configured Python package index without specifying a reviewed version or verifying an integrity hash. The repository contains no lock file, hash-locked requirements file, vendored implementation, or other mechanism that binds installation to audited package content.

Consequently, the code installed and executed can change after this skill has been reviewed. Risk arises if the package, one of its transitive dependencies, the package publishing account, or the configured package index is compromised. Because Python packages may execute installation or build logic, malicious behavior could occur during installation. Malicious code could also run when the documented CLI or module entry point is subsequently invoked.

This finding does not establish that the current nestedpdfmerger package is malicious. It identifies the absence of controls needed to prevent an unreviewed or compromised future release from being installed.

Attack Path

1. An attacker compromises the package publisher, publishes a malicious future release, compromises a transitive dependency, or controls the package source configured for pip.
2. A user follows the skill's recommendation and runs pip install nestedpdfmerger.
3. pip resolves the unpinned package name to attacker-controlled or otherwise unreviewed package content.
4. Malicious code executes during package installation, build processing, or later invocation of nestedpdfmerger.
5. The code operates with the privileges of the u ...[truncated 819 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed release:

   bash

   python -m pip install nestedpdfmerger==<reviewed-version>
   

2. Publish a hash-locked requirements file containing the package and every transitive dependency, then require integrity verification:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Record the reviewed package version, expected hashes, official package index, and upstream source repository in the skill documentation.

4. Install the dependency in an isolated virtual environment rather than the user's global Python environment.

5. Review the pinned distribution artifacts and transitive dependencies before recommending them, including package build configuration and installation hooks.

6. Define an explicit update process in which new versions and hashes are reviewed before changing the documented installation command.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.