pymupdf

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:18 AM UTC
• Version: 1.0.0

Overview

This skill performs local PDF image rendering and extraction with no evidence of hidden network, credential, persistence, or destructive behavior.

Before installing, treat this as a local PDF rendering/extraction helper, not a redaction or annotation tool. Install PyMuPDF in a virtual environment and consider pinning a reviewed version. Choose output directories deliberately because exported images may overwrite same-named prior outputs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 38
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

- Install dependency if missing: `pip install pymupdf`.

Technical Analysis

The skill instructs users or agents to install PyMuPDF without a fixed version or package integrity hashes. This allows package resolution to select a mutable, unreviewed release rather than the exact dependency version assessed with the skill.

If the upstream package, its publishing account, or the package distribution infrastructure is compromised, the selected release could contain malicious installation or runtime code. Unexpected upstream changes could also alter behavior or introduce newly disclosed vulnerabilities. Package-controlled code may run during installation and will run when fitz is imported by scripts/pymupdf_cli.py.

This finding concerns supply-chain integrity. The audit found no evidence that the current project intentionally retrieves a malicious package.

Attack Path

1. PyMuPDF is absent from the local Python environment.
2. A user or agent follows the instruction in SKILL.md.
3. pip install pymupdf resolves the latest package version available from the configured package index.
4. An attacker has compromised the upstream release, publisher account, dependency chain, or configured package source.
5. The compromised package executes installation-time or import-time code with the privileges of the user running pip or the CLI.
6. The attacker can act within that user's permissions and the Python environment's accessible resources.

Impact Assessment

Successful exploitation could execute arbitrary code with the installing user's privileges. Depending on those privileges and the host environment, this could expose files, environment variables, credentials available to the process, and writable project or user directories. It could also modify the Python environme ...[truncated 223 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin PyMuPDF to a specifically reviewed version instead of installing an unconstrained latest release.
2. Record the dependency in a lock file or requirements file containing cryptographic hashes.
3. Install with hash verification, for example:

bash

python -m pip install --require-hashes -r requirements.txt

4. Use the official package index explicitly and review any organization-level package-index configuration to reduce dependency-confusion risk.
5. Perform installation inside an isolated virtual environment with only the permissions required for PDF processing.
6. Add automated dependency vulnerability and integrity checks, and update the pinned release only after review and testing.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code does support part of the description: rendering PDF pages to images, extracting embedded images, and limited inspection via page count, metadata, and dimensions. However, it does not implement annotation, drawing, redaction, or broader PDF manipulation/inspection capabilities described as supported uses. Since the declared description presents a substantially broader capability set than the code actually provides, the description does not accurately represent the code chunk's behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents commands that write files to an output directory, but it declares no explicit tool scope or permissions boundary. That creates an authorization gap: an agent may invoke file-writing behavior without a clear policy constraint, increasing the chance of unintended writes or misuse in broader workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.