T08 · Insecure Dependencies
Warning
- Location
SKILL.md:15- Finding
Unpinned Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
universal-pdf-vision-parser
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but it sends chosen PDF page images to DashScope/Qwen and needs careful API-key handling.
Install only in a controlled Python environment, prefer DASHSCOPE_API_KEY or a secret manager instead of putting keys on the command line, avoid sending sensitive PDFs unless you are comfortable with DashScope/Qwen processing their page images, and choose an output path that will not overwrite important files.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:24- Finding
API Key Exposure Through Command-Line Arguments
- Content
View full analysis
--out --api-key --max-pages 2 ``` The script accepts and prioritizes that command-line value at `scripts/vision_parse.py:62-67`: ```python parser = argparse.ArgumentParser(description="French PDF Vision Parser Skill (v0.1)") parser.add_argument("--pdf", required=True, help="Input PDF path") parser.add_argument("--out", required=True, help="Output Markdown path") parser.add_argument("--api-key", required=False, help="DashScope API Key") parser.add_argument("--max-pages", type=int, default=2, help="Max pages to process (default 2, -1 for all)") args = parser.parse_args() api_key = args.api_key or os.getenv("DASHSCOPE_API_KEY") ``` ### Technical Analysis Command-line arguments are commonly retained in interactive shell history and may be captured by terminal recording, job runners, monitoring agents, diagnostic reports, or CI logs. Depending on operating-system process visibility rules, command arguments may also be observable by other local users while the process is running. Although the script supports the `DASHSCOPE_API_KEY` environment variable, the documented basic command encourages the less secure command-line mechanism. The program also gives the exposed command-line value precedence over the environment variable. This issue does not constitute privilege escalation by itself. It creates a credential-disclosure path that can allow an observer to act with the cloud-service permissions associated with the stolen API key. ### Attack Path 1. A user follows the documented example and includes a valid DashScope API key in th ...[truncated 916 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill invokes a Python script that requires environment access for an API key and writes output files, but the manifest does not declare any tool scope or permissions. This can cause agents or users to run the skill without clear boundaries on filesystem and secret-handling behavior, increasing the chance of unintended file writes or unsafe access to sensitive environment data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill sends rendered PDF page images to the external Qwen-VL-Max API, but the description does not warn users that document contents leave the local environment. PDFs often contain sensitive personal, legal, financial, or proprietary information, so omission of this disclosure can lead to unintentional data exfiltration to a third-party service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script sends rendered PDF page images to a third-party vision API, which can disclose sensitive document contents to an external service without an explicit runtime warning or consent checkpoint. In this skill's context, PDFs may contain personal, financial, educational, or proprietary information, so silent transmission meaningfully increases privacy and compliance risk.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The docstring says the function will transcribe "the French-Chinese notes," but the manifest describes a multilingual PDF parser for many languages and the prompt/code operate on generic document and language-learning content. This is an active documentation contradiction about intended scope, not just missing detail.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The argument parser description labels the tool as a "French PDF Vision Parser Skill," while the manifest says it is a universal multilingual parser and the prompt explicitly targets multilingual documents. This creates an intent-code/documentation mismatch about what the skill is for.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
Opening the output path with mode 'w' will create or overwrite the target file. Although writing output is part of the tool's purpose, the code provides no confirmation prompt or explicit notice that an existing file may be replaced.
- Content