Ingest Document

• Outcome: Review
• Latest audit: Jun 24, 2026 · 2:36 PM UTC
• Version: 1.1.2

Overview

This skill appears intended to save documents into a Gitea-backed knowledge base, but it uses broad repository credentials and can write or archive user content with limited scoping controls.

Install only if you are comfortable giving this skill write access to the intended Gitea knowledge-base repositories. Use a dedicated low-privilege token limited to those repos, avoid a site-admin token, pin and audit dependencies, and make sure users know when full source files will be archived and who can access them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes multiple local scripts, reads uploaded content, writes temporary and persisted files, and returns network-hosted Gitea URLs, but it declares no explicit permissions or capability boundaries. That creates a real security governance gap: reviewers and runtime policy engines cannot clearly constrain file, environment, or network access, increasing the chance of over-privileged execution or misuse of sensitive workspace data.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This helper wraps site-admin-capable Gitea operations, including checking admin access and creating repositories for arbitrary users via /admin/users/{username}/repos. In a document-ingestion skill, that is excessive privilege and expands blast radius: compromise or misuse of this module could create or alter resources across other users’ namespaces, not just a constrained bot-owned area.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script directly writes attacker-controlled content to a remote repository path and updates catalog metadata, which is broader than a narrowly scoped single-document ingest flow. Although it performs a simple name sanitization and basic replacement by exact name, it lacks stronger workflow controls such as repository scoping, content validation, authorization checks, and robust duplicate/aggregation handling, so it can be used to create or overwrite arbitrary knowledge-base pages within the target repo.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Accepting owner and repo as unrestricted command-line inputs allows the skill to target arbitrary remote repositories reachable by the configured credentials, not just the intended personal or team knowledge base. In an agent context, this materially increases the blast radius: if the agent is induced to invoke the skill with attacker-chosen arguments, it could modify unrelated repositories, causing unauthorized content creation, overwrite, or defacement.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This module manages a broad control-plane repository and central state for users, teams, chat bindings, permissions, jobs, and sources, which is far beyond the stated scope of ingesting a single document. In a skill that should handle document ingestion, hidden access to global control-plane state increases the blast radius of compromise and enables unauthorized persistence or cross-tenant manipulation if this code is reachable.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The initialization routine provisions and maintains files for chat bindings, pending bindings, events, users, teams, and permissions even though those capabilities are not justified by the skill's declared purpose. This kind of overbroad state management can be abused to alter identity or access-control metadata and is especially dangerous because it silently creates and updates a shared system repository.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly archives the original source file into the knowledge base via `--source_file_path`, but the user-facing reply requirements never require clear notice, consent, or retention disclosure. This is dangerous because users may submit sensitive documents expecting summarization only, while the full original is retained and potentially exposed to broader personal/team access, creating privacy, confidentiality, and data-retention risk.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

_load_env()

GITEA_URL = os.environ.get("GITEA_URL", "").rstrip("/")
ADMIN_TOKEN = os.environ.get("GITEA_ADMIN_TOKEN", "")
BOT_USERNAME = os.environ.get("GITEA_BOT_USERNAME", "AIFusionBot")

• Confidence: 70% confidence
• Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Credential Access

High

• Category: Privilege Escalation

Content

except ImportError:
        return
    here = Path(__file__).resolve().parent
    for candidate in (here / ".env", here.parent / ".env"):
        if candidate.exists():
            load_dotenv(candidate)
            return

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

except ImportError:
        return
    here = Path(__file__).resolve().parent
    for candidate in (here / ".env", here.parent / ".env"):
        if candidate.exists():
            load_dotenv(candidate)
            return

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
set -e
python3 -m pip install -r requirements.txt
if [ ! -f .env ]; then cp env-example.txt .env; fi
echo "setup complete"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv
pymupdf
python-docx

• Confidence: 97% confidence
• Finding: The dependency list leaves requests unpinned, so builds may resolve to different versions over time, including versions with known security flaws or breaking behavior. In a document-ingestion skill that may fetch or process external content, uncontrolled dependency drift increases supply-chain and reliability risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv
pymupdf
python-docx
openpyxl

• Confidence: 97% confidence
• Finding: python-dotenv is unpinned, which makes deployments non-reproducible and can pull in future vulnerable or incompatible releases. While the package itself is usually lower-risk than network or parser libraries, leaving it floating still weakens supply-chain control.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv
pymupdf
python-docx
openpyxl
xlrd

• Confidence: 97% confidence
• Finding: PyMuPDF is unpinned even though it processes complex document formats, and parser libraries are common attack surfaces. In a skill designed to ingest uploaded files, version drift can expose the system to newly introduced or previously known parsing vulnerabilities.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
python-dotenv
pymupdf
python-docx
openpyxl
xlrd

• Confidence: 99% confidence
• Finding: python-docx is unpinned and is used to parse user-supplied Office documents, which makes this more dangerous in context. Floating to an unsafe version could expose the ingestion pipeline to XML-based parser vulnerabilities, including known XXE issues in older releases.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-dotenv
pymupdf
python-docx
openpyxl
xlrd

• Confidence: 99% confidence
• Finding: openpyxl is unpinned despite being used for spreadsheet parsing, an area with a history of XML entity and parser issues. Because this skill ingests externally provided files, uncontrolled upgrades or downgrades materially increase exposure to exploitable parsing bugs.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pymupdf
python-docx
openpyxl
xlrd

• Confidence: 94% confidence
• Finding: xlrd is unpinned, creating the same reproducibility and supply-chain drift problem as the other packages. Since it may parse spreadsheet content from users, an unexpected vulnerable version could increase the attack surface of the ingestion workflow.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The requirements file includes requests without a version constraint, and the scanner reports multiple advisories affecting some requests versions. In a document-ingestion workflow that may retrieve remote resources or interact with external services, vulnerable requests releases can lead to credential leakage, TLS/verification issues, or other network-security failures.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: The file includes python-dotenv without a pinned safe version, and the scanner identifies an advisory related to symlink-following during set_key operations. This is lower impact unless the skill actually writes .env files in attacker-influenced locations, but as listed it still represents exposure to a vulnerable dependency range.

Known Vulnerable Dependency: pymupdf — 1 advisory(ies): CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)

Low

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: PyMuPDF is flagged for a path traversal issue in its CLI entrypoint, which may or may not be reachable depending on how the skill uses the library. Because this skill ingests documents, the package is in a sensitive area, but the specific advisory appears less severe if only the Python API is used and not the vulnerable command-line path.

Known Vulnerable Dependency: python-docx — 2 advisory(ies): CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: python-docx is associated with a known XXE vulnerability in older versions, which is especially relevant because this skill ingests user-provided DOCX files. XXE can permit outbound requests, local file disclosure, or parser abuse when malicious XML content is processed.

Known Vulnerable Dependency: openpyxl — 2 advisory(ies): CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: openpyxl is flagged for a known XXE issue in affected versions, and spreadsheet ingestion from users makes this highly relevant. Malicious XLSX content could trigger external entity resolution, potentially exposing local files or enabling unexpected network access during parsing.

Static analysis

No suspicious patterns detected.