Security audit

Formula—PDF

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a PDF-rendering helper, but its artifacts include an overbroad option or workflow that can forcibly close all Microsoft Edge processes on the user’s machine.

Review before installing. Use only if you are comfortable with headless Edge automation and external MathJax loading, and avoid any --kill-edge or force-kill workflow unless you have saved browser work and explicitly want all Edge windows closed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to invoke PowerShell and Edge headless, which are shell-capable actions, but no permissions are declared. This creates a trust and containment gap: a caller may believe the skill is documentation-only while it can actually execute local commands and access files needed for rendering.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The HTML template loads MathJax from a public CDN, introducing external network dependency into a workflow presented as local PDF generation. This can leak usage metadata, fail unpredictably in restricted environments, and expose the rendering pipeline to third-party script supply-chain risk.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The template fetches MathJax from a third-party CDN at render time, which introduces external network dependency into what should otherwise be a local document-to-PDF conversion flow. If the CDN content is unavailable, tampered with, or monitored, the renderer may execute untrusted JavaScript in the headless browser context, affecting integrity, privacy, and reproducibility of generated PDFs.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The document contains contradictory guidance: it explicitly warns not to kill Edge because doing so disrupts the user's active browser session, then later instructs `Stop-Process -Name msedge -Force` as part of the workflow. In a PDF-rendering skill, force-terminating all Edge processes is unnecessary and harmful because it can close unrelated user work and cause data/session loss.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The workflow grants itself the ability to forcibly terminate every Edge process on the machine, which exceeds the stated purpose of rendering formula content to PDF. This broad process-kill behavior creates an avoidable denial-of-service against the user's browser activity and could interrupt downloads, form submissions, or unsaved work.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The helper forcibly terminates all local `msedge.exe` processes, not just the instance created for PDF rendering. In an agent/tooling context this is broader than necessary and can disrupt user sessions, destroy unsaved work, and act as a local denial-of-service against other browser-based tasks.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The README instructs loading MathJax from a public CDN, which causes network access during document rendering and exposes metadata such as IP address, timing, and possibly document-related access patterns to a third party. In a document-generation skill, especially one that may process sensitive academic, technical, or internal content, undisclosed external dependency fetching creates a real privacy and supply-chain risk even if it is not directly code-execution by itself.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This recommendation tells the operator to force-kill all Edge processes without warning that active browsing sessions may be terminated. Even if intended as troubleshooting advice, omitting the disruption warning increases the chance of accidental user harm and makes an unsafe operation appear routine.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Embedding force-termination as a standard workflow step normalizes a disruptive action without user notice or consent. In context, this is more dangerous because the skill operates in a document-generation scenario where users would not reasonably expect their interactive browser sessions to be closed.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The `--kill-edge` option enables destructive behavior without any explicit runtime warning or confirmation that all Edge processes will be forcibly closed. In a skill used by an automation agent, users may not realize this side effect, increasing the chance of unintended disruption and data loss.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.