X 92bilal26 Pdf

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:27 AM UTC
• Version: 1.0.0

Overview

This is a coherent PDF-processing skill, but users should treat generated files, passwords, dependencies, and marketplace installs carefully.

Install only from a source or release you trust, preferably pinned or checksummed. Use a private working directory for PDFs and generated JSON/images, avoid cloud-synced folders for sensitive forms, clean up intermediates after use, and only decrypt or remove PDF password protection for documents you are authorized to access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:215

Finding

Unpinned Python Dependencies Allow Supply-Chain Substitution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:215
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

python

# Requires: pip install pytesseract pdf2image

Technical Analysis

The installation instruction retrieves pytesseract and pdf2image without fixed versions, package hashes, a lockfile, or an explicitly trusted package index. Dependency resolution can therefore select package releases that were not part of this audit.

Python package installation and subsequent imports can execute package-controlled code. If a package publisher account, upstream release, package index, or dependency-resolution environment is compromised, following this instruction could introduce attacker-controlled code.

No evidence was found that the currently named packages are malicious. The risk arises from the mutable and unverifiable dependency installation process.

Attack Path

1. An attacker compromises a named dependency, one of its transitive dependencies, or the package distribution channel.
2. The attacker publishes a malicious release that remains compatible with the unpinned package name.
3. A user follows the documented pip install pytesseract pdf2image instruction.
4. pip resolves and installs the attacker-controlled release.
5. Malicious code executes during installation or when the dependency is imported and used for PDF processing.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pip or the PDF-processing agent. Depending on those privileges, the attacker could read or modify accessible files, tamper with generated documents, access environment-held secrets, or establish further execution channels. The affected scope is the installation environment and resources available to that user; the audited repository itself contains no privilege-escalation mechanism.

Remediation

View remediation

Remediation Suggestions

• Declare all direct and transitive dependencies in a reviewed lockfile.
• Pin exact versions rather than using unconstrained package names.
• Record cryptographic hashes and install with a command such as pip install --require-hashes -r requirements.txt.
• Configure an explicitly trusted package index and disable unexpected fallback indexes.
• Run dependency installation and PDF processing in an isolated, least-privileged virtual environment or container.
• Add automated dependency vulnerability and provenance checks to the release process.
• Review and deliberately update the lockfile rather than resolving the newest available packages during installation.

T08 · Insecure Dependencies

Warning

• Location: README.md:13

Finding

Marketplace Installation Is Not Pinned to an Audited Artifact

Content

View full analysis

Vulnerability Details

File Location: README.md:13-17
Vulnerability Type: Mutable external plugin dependency
Risk Level: Medium

Vulnerable Code

text

### Via Claude Code Plugin System

/plugin marketplace add aiskillstore/marketplace
/plugin install x-92bilal26-pdf@aiskillstore

Technical Analysis

The documented commands register an external marketplace and install a plugin by a mutable marketplace identifier. They do not specify an immutable version, commit digest, checksum, signature-verification procedure, or other mechanism that binds the installation to the locally audited files.

Consequently, the artifact obtained when a user follows these instructions may differ from the artifact examined during this audit. Because an agent skill can contain instructions and executable scripts, compromise of the marketplace, publisher account, or distribution metadata could supply content capable of changing agent behavior or executing local code.

No evidence was found that the referenced marketplace or current plugin is malicious. The vulnerability is the absence of integrity and provenance controls over future installations.

Attack Path

1. An attacker compromises the marketplace, the plugin publisher account, or the plugin distribution path.
2. The attacker replaces or updates the plugin associated with x-92bilal26-pdf@aiskillstore.
3. A user executes the documented marketplace registration and installation commands.
4. The plugin system retrieves the modified artifact rather than the version audited here.
5. When loaded or invoked, malicious skill instructions or scripts execute within the agent's available permissions.

Impact Assessment

A substituted skill could alter agent workflows, access files available to the agent, process sensitive PDFs, invoke permitted tools, or execute local code under the agent user's privileges. The exact impact depends on the plugin system's sandbox and granted tool permissions. The audited ...[truncated 118 chars]

Remediation

View remediation

Remediation Suggestions

• Pin installation to an immutable plugin release, content digest, or source commit.
• Publish a cryptographic checksum or signed manifest for each approved artifact.
• Require signature and checksum verification before the skill is activated.
• Document the expected resolved version and compare its contents with the reviewed artifact.
• Review marketplace-delivered updates before deployment instead of enabling implicit replacement.
• Restrict plugin execution to a least-privileged sandbox with only the filesystem and tools required for PDF processing.
• Provide a reproducible, locally verifiable installation method for security-sensitive environments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied code chunk does not implement a comprehensive PDF manipulation toolkit. It is a unittest module that exercises a helper function for checking intersections and sizing constraints of form field bounding boxes from JSON input. While this is loosely related to PDF form layout/handling, its actual purpose is narrow testing/documentation of bounding-box validation behavior, not text/table extraction, PDF creation, document merging/splitting, or general PDF processing at scale. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code’s actual function is to rasterize PDF pages into PNG files and save them to disk. That is a PDF-processing capability, but it is not represented in the declared description, which specifically lists extracting text and tables, creating new PDFs, merging/splitting documents, and handling forms. Since the evaluation criteria call for flagging undeclared capabilities and materially different primary purpose, this should be considered a mismatch. The code does not access suspicious resources or perform unrelated actions; the mismatch is that its concrete capability—PDF-to-image conversion—is absent from the stated description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says the skill applies 'when Claude needs to fill in a PDF form or programmatically process, generate, or analyze PDF documents at scale,' which is a very broad invocation condition rather than a specific trigger phrase or constrained scope. It does not provide explicit boundaries or negative examples, increasing the chance of unintended activation for many ordinary PDF-related requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow explicitly instructs creation of JSON files, page images, and filled PDFs that can contain sensitive personal or form data, but provides no warning about persistence, storage location, cleanup, or access control. In a PDF form-processing skill, these artifacts are especially likely to contain PII, so omission of handling guidance materially increases the risk of unintended disclosure on shared machines, retained workspaces, logs, backups, or synced directories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The non-fillable workflow requires generating fields.json, validation images, and annotated output PDFs, all of which may directly expose entered values and form structure, yet it omits any warning that these files persist sensitive data on disk. Because this branch additionally requires visual validation images, it can create even broader exposure than the fillable path by producing multiple human-readable artifacts containing user information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The reference includes explicit examples for decrypting password-protected PDFs and removing password protection, but it does not warn about lawful use, secure credential handling, or the sensitivity of protected documents. In an agent skill, such examples can normalize unsafe handling of credentials or facilitate unauthorized processing of protected files if the agent applies them without policy checks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The troubleshooting example uses an in-place repair command that overwrites the original PDF without any warning or backup guidance. In an automated agent context, this increases the risk of accidental destruction of user data, especially when the input document is already corrupted and may be the only copy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.