Utilia PDF to Markdown

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:27 AM UTC
• Version: 1.0.6

Overview

This skill is coherent, but it asks an agent to run a downloaded npm client with access to a funded Solana wallet file.

Install only if you are comfortable running the specified npm package locally. Use a dedicated wallet with the smallest practical USDC/SOL balance, do not point it at a personal or high-value keypair, send only public PDFs unless you explicitly approve private-file upload, and prefer running it in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unaudited npm Package Is Downloaded and Executed with Access to a Wallet Path

Content

View full analysis

``` ```sh npx -y utilia-solana-agent@0.5.7 pdf-to-markdown --max-pages 100 ``` ### Technical Analysis The Skill directs the agent to use `npx -y` to retrieve and execute the third-party `utilia-solana-agent` package from npm. Although the package version is pinned to `0.5.7`, version pinning alone does not verify package integrity or constrain its runtime behavior. The project does not include the package source, a lockfile, verified integrity hashes, cryptographic signatures, or package provenance evidence. The `-y` option also suppresses the normal installation confirmation. Consequently, the package and its transitive dependencies execute without local review and with the permissions and environment inherited from the agent process. The instructions require `SOLANA_KEYPAIR_PATH` to point to a Solana keypair file before these commands are run. Code executed through npm could therefore discover the path through the environment and attempt to read the keypair if filesystem permissions permit. The Skill's instruction not to print or transmit keypair contents does not technically restrict the downloaded package. ### Attack Path 1. A user configures `SOLANA_KEYPAIR_PATH` as instructed, pointing it to a funded Solana keypair file. 2. The agent invokes one of the documented `npx -y utilia-solana-agent@0.5.7` commands. 3. `npx` downloads the package and any required dependencies from the npm supply chain. 4. npm executes the retrieved code with the agent process's user permissions and inherited environment. 5. If the package, publisher account, registry artifact, or a transitive dependency is compromised, malicious code reads `SOLANA_KEYP ...[truncated 935 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

export SOLANA_KEYPAIR_PATH=/absolute/path/to/low-balance-agent-wallet.json

text

Never print, log, paste, or transmit the keypair contents. Do not ask the user to put
a raw private key in the prompt or command line. The wallet should hold only a small
USDC balance and enough SOL for fees. If `SOLANA_KEYPAIR_PATH` is not set, ask the
user to configure it.

Static analysis

No suspicious patterns detected.