Security audit

Pdfreader

Security checks for vulnerabilities and agentic risk

Overview

This PDF-reading skill is not deceptive, but its stated current-folder safety boundary can be bypassed with symlinks, allowing unintended local file reads or overwrites.

Review before installing. Run it only in a trusted working directory, avoid untrusted symlinks, use a virtual environment with a pinned PyMuPDF version, and do not rely on its current-directory restriction until path handling is fixed to reject or safely resolve symlinks.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: pdf_reader.py:20
Finding: Working-directory restriction can be bypassed through symbolic links
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:6
Finding: Third-party dependency is installed without version or integrity pinning
Content: View full analysis
Remediation: View remediation
" ``` 2. Maintain dependencies in a requirements or lock file containing cryptographic hashes. Install them with hash verification: ```powershell pip install --require-hashes -r requirements.txt ``` 3. Generate hashes from trusted, reviewed artifacts and update them through a controlled dependency-review process. 4. Explicitly use the intended official package index and avoid untrusted extra indexes or mirrors. 5. Run dependency vulnerability and provenance checks during releases and continuous integration. 6. Install and execute the skill in an isolated virtual environment under a non-privileged account. 7. Document a repeatable dependency-update procedure that includes version review, security advisory checks, tests, and lock-file regeneration. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
- `SKILL.md` - This documentation

Static analysis

No suspicious patterns detected.