Security audit

pdf_ssssssss

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent PDF-processing skill that works locally, but users should be careful because some examples create or overwrite files.

Install only if you are comfortable with a skill that reads PDFs and creates local PDF, JSON, text, and image outputs. Work on copies of important documents, avoid running in-place repair commands on originals, review output paths before execution, and treat PDFs from untrusted sources as potentially hostile parser inputs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:235
Finding: Unpinned Third-Party Dependencies in OCR Installation Guidance
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose describes a broad PDF processing skill, but the supplied code only validates bounding boxes in a JSON structure containing form field metadata. It checks rectangle intersections on the same page and verifies entry box height against font size. It neither opens nor manipulates PDFs, nor performs any of the listed PDF-related capabilities. This is a materially different primary purpose, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description claims a wide-ranging PDF skill covering many operations, but the provided code only rasterizes PDF pages into PNG files. That specific behavior is materially narrower than the declared purpose and is not clearly included in the listed capabilities. While the description mentions extracting images from PDFs, that typically means pulling embedded images out of the PDF, not rendering each page as an image. Therefore the actual code's primary purpose does not accurately match the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a broad PDF-processing skill covering extraction, merging, splitting, rotation, watermarking, form filling, encryption, OCR, and more. The supplied code does none of those things directly. Instead, it reads form field metadata from JSON and draws rectangles onto an image for a given page. This is a materially different primary purpose and uses different resources (JSON + image files rather than PDFs). While it may be part of a larger PDF-related pipeline, this code chunk itself is not accurately represented by the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This is a clear description-to-behavior mismatch. The declared description presents the skill as a broad PDF toolbox covering many distinct document operations. The supplied code chunk has a much narrower, specific purpose: extracting PDF form field structure and location information into JSON. While this behavior is PDF-related, it does not substantiate the broad claims in the description, and its primary purpose is materially different from a general PDF manipulation/extraction skill. There is no evidence in this chunk of merging, splitting, rotating, watermarking, creating PDFs, filling forms, encryption/decryption, image extraction, OCR, or text/table extraction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description presents a general-purpose PDF manipulation/extraction skill covering a wide range of common PDF tasks. The supplied code does not implement that broad functionality. Instead, it performs a specific analysis task on PDFs—detecting text labels, lines, checkbox-like rectangles, and row boundaries to build form field coordinates. While this is PDF-related and loosely adjacent to 'reading/extracting' content, the code's primary purpose is materially narrower and different from the declared general PDF utility. Therefore the description does not accurately represent the actual behavior of this code chunk.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The activation text says to use the skill whenever the user mentions a PDF or asks to produce one, which is overly broad for a skill that can read, write, decrypt, OCR, and transform files. Overbroad routing increases the chance the agent invokes filesystem-affecting or sensitive-document processing without sufficiently clear user intent or narrower task selection.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guidance includes qpdf --replace-input corrupted.pdf, which performs an in-place modification of the original file without emphasizing that the source document will be altered. In an agent context, this is risky because an automated system may execute the command on the only copy of a user document, causing irreversible loss or corruption if the repair fails or produces unintended output.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents and encourages file read/write operations on local PDFs but does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization ambiguity where an orchestrator may expose broader filesystem capabilities than intended, making unintended file access or overwrite more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The workflow directs creation of field metadata and filled output files that are likely to contain sensitive personal information, but provides no warning about privacy, storage location, retention, or cleanup. This can lead to inadvertent disclosure of PII through local disk artifacts, logs, temporary files, or shared working directories.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs use of external shell/ImageMagick commands on user-supplied PDF-derived files. Even though the markdown itself is not executing code, invoking external tooling on potentially hostile PDFs/images increases attack surface because ImageMagick and related converters have a long history of parser/delegate vulnerabilities and dangerous file-handling behaviors.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The non-fillable form path produces annotated PDFs and verification images that may embed highly sensitive form contents, yet the instructions omit user-facing warnings about writing these artifacts to disk. The additional generation of verification images further expands exposure by creating extra copies of sensitive data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown reference includes command-line examples that create or overwrite files such as output images, merged PDFs, encrypted/decrypted PDFs, and structure dumps, but it does not warn users that running them will write artifacts to disk and may replace existing files. Under the markdown-file criteria for SQP-2, descriptions should disclose behaviors that could affect user data or system integrity.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The CLI usage string and function name/documented intent indicate this script fills a PDF form, but the implementation constructs FreeText annotations and adds them with writer.add_annotation(...). That is materially different from setting actual PDF form field values, since annotations are overlays rather than form data entries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This code performs a file write operation via open(json_output_path, "w") and overwrites the target path if it already exists. Although it prints after writing succeeds, there is no pre-write confirmation, cautionary comment, or other disclosure in this file warning users that running the script will create or replace the specified JSON output file.
Content: No source excerpt is available for this finding.