Ai Pdf Builder

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:31 AM UTC
• Version: 1.2.3

Overview

The skill has a coherent PDF-generation purpose, but it asks agents to run mutable npm code and process sensitive legal/business documents with AI without enough scoping or privacy disclosure.

Review before installing. Use a pinned, reviewed version of `ai-pdf-builder`, avoid running unpinned `npx` commands automatically, and do not process confidential legal, investor, or business documents through AI features unless you are comfortable sending that content to the configured provider. Run the tool with least privilege and expose only the needed input/output files and API key.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55

Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:55-92; supporting version inconsistency at README.md:5-7
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

SKILL.md:53-92:

bash

### Check System
```bash
npx ai-pdf-builder check

Generate via CLI

bash

# From markdown file
npx ai-pdf-builder generate whitepaper ./content.md -o output.pdf

# With company name
npx ai-pdf-builder generate whitepaper ./content.md -o output.pdf --company "Acme Corp"

# Document types: whitepaper, memo, agreement, termsheet, safe, nda, report, proposal

AI Content Generation (New!)

bash

# Generate a whitepaper from a prompt
npx ai-pdf-builder ai whitepaper "Write a whitepaper about decentralized identity" -o identity.pdf

# Generate with company branding
npx ai-pdf-builder ai whitepaper "AI in healthcare" -o healthcare.pdf --company "HealthTech Inc"

# Generate other document types
npx ai-pdf-builder ai termsheet "Series A for a fintech startup" -o termsheet.pdf
npx ai-pdf-builder ai memo "Q4 strategy update" -o memo.pdf --company "TechCorp"

Enhance Existing Content (New!)

bash

# Improve and expand existing markdown
npx ai-pdf-builder enhance ./draft.md -o enhanced.md

# Enhance and convert to PDF in one step
npx ai-pdf-builder enhance ./draft.md -o enhanced.pdf --pdf

Summarize Documents (New!)

bash

# Generate executive summary
npx ai-pdf-builder summarize ./long-document.md -o summary.md

# Summarize as PDF
npx ai-pdf-builder summarize ./report.pdf -o summary.pdf --pdf

text

`README.md:5-7` documents a particular release but does not enforce it in the commands:

```markdown
## Version

Uses `ai-pdf-builder@0.4.0` with premium templates.

Technical Analysis

All documented CLI commands invoke npx ai-pdf-builder without specifying a package version. If the pa ...[truncated 2336 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every invocation to a specific reviewed release:

   bash

   npx --yes ai-pdf-builder@0.4.0 check
   npx --yes ai-pdf-builder@0.4.0 generate whitepaper ./content.md -o output.pdf
   npx --yes ai-pdf-builder@0.4.0 summarize ./report.pdf -o summary.pdf --pdf
   

2. Prefer declaring the package as a local project dependency and committing a lockfile with npm integrity metadata:

   bash

   npm install --save-exact ai-pdf-builder@0.4.0
   npm ci
   npx --no-install ai-pdf-builder check
   

3. Review the pinned package, its lifecycle scripts, and its complete transitive dependency tree before approving it for sensitive document processing.

4. Reconcile the version information in README.md and SKILL.md, and explicitly distinguish the Skill version from the npm package version.

5. Run document generation with least privilege in an isolated environment that exposes only required input and output directories.

6. Avoid exposing unrelated credentials to the process. Provide ANTHROPIC_API_KEY only for commands that require it and use a narrowly scoped key where supported.

7. Apply outbound network restrictions when local PDF generation does not require network access, reducing the impact of a compromised dependency.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The manifest/metadata advertises npx ai-pdf-builder without a version pin, normalizing insecure execution from the registry. This broadens exposure because tooling may ingest the metadata directly and invoke the package automatically.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill repeatedly instructs users/agents to run npx ai-pdf-builder without pinning an exact package version. Because npx resolves and executes the current package from the registry, a compromised maintainer account, malicious update, or dependency hijack could cause arbitrary code execution on the host at invocation time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises AI generation, enhancement, and summarization using Claude/Anthropic but does not clearly warn that user prompts or document content may be transmitted to a third-party API. In this context, the documents include legal agreements, investor materials, and reports, so omission of a disclosure materially increases confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

# macOS
brew install pandoc
brew install --cask basictex
sudo tlmgr install collection-fontsrecommended fancyhdr titlesec enumitem xcolor booktabs longtable geometry hyperref graphicx setspace array multirow

# Linux
sudo apt-get install pandoc texlive-full

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

sudo tlmgr install collection-fontsrecommended fancyhdr titlesec enumitem xcolor booktabs longtable geometry hyperref graphicx setspace array multirow

Linux

sudo apt-get install pandoc texlive-full

text

**Option B: Cloud API (Coming Soon)**

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This command uses npx ai-pdf-builder without a version pin, which allows whatever version is currently published to be fetched and executed. In an agent context, that creates a software supply-chain risk that can become immediate arbitrary code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The documented npx invocation is unpinned and may execute a newly published or tampered package version. Since the skill is intended for AI agents, the likelihood of automatic execution without human scrutiny makes the supply-chain exposure more dangerous.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This example invokes an unversioned npx package, enabling remote code execution if the npm package or one of its fetched dependencies is compromised. The risk is amplified because the command may be copied directly by users or executed by autonomous tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill suggests unpinned npx execution for AI document generation. That means package code from the live registry is trusted at runtime, creating a direct path for supply-chain compromise and arbitrary local command execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This command uses npx without a version constraint, so the executed code may differ over time and can be replaced by a malicious release. In a skill designed for agents, automatic execution increases the practical exploitability of that supply-chain weakness.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The example fetches and runs ai-pdf-builder from npm without an exact version. Any malicious publish, account takeover, or dependency substitution could result in execution of attacker-controlled code on the machine following the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This is another unpinned npx invocation, which creates a registry trust boundary violation by executing mutable remote package content. Because the skill targets legal/business workflows, compromise could expose sensitive documents in addition to enabling arbitrary code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The enhance example relies on unpinned npx execution, exposing users to supply-chain compromise. Since the command processes local files, a malicious package could both execute arbitrary code and exfiltrate document contents.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This example again executes mutable registry content via npx without version pinning. The danger is not limited to build instability; it can become full host compromise if a malicious version is served.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The summarize example uses an unpinned npx command, which can execute arbitrary code from a changing upstream package. Because it may ingest long or confidential documents, the operational impact includes both code execution and data leakage.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This command invokes the package from npm without a fixed version, leaving execution dependent on mutable remote state. In agent-driven environments, such examples are especially risky because they are likely to be followed programmatically and repeatedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The agent instructions direct the agent to gather document content, possibly use AI generation, produce the PDF, and send it back without any requirement to assess sensitivity, obtain consent for third-party processing, or verify safe destination handling. Because the skill is aimed at legal and business documents, this omission can lead to accidental disclosure of confidential or regulated information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.