pdfparse

• Outcome: Pass
• Latest audit: Oct 30, 2026 · 6:40 PM UTC
• Version: 0.1.0

Overview

The skill performs the disclosed local PDF conversion, with ordinary dependency and output-overwrite precautions.

Use a maintained, patched PyMuPDF release and record its exact version. Choose a separate output directory and check for naming collisions before batch conversion. Bibliographies are removed unless you select --keep-references.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/self_test.py (reported line 65)May include surrounding context.

python

def run(*args: str) -> subprocess.CompletedProcess:
    return subprocess.run(
        [sys.executable, str(PARSE_MANY), *args],
        capture_output=True, text=True,
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/self_test.py (reported line 184)May include surrounding context.

python

# 8. --json (single file) → valid JSON with the documented keys.
    out8 = tmp / "out8"
    r8 = subprocess.run(
        [sys.executable, str(HERE / "pdf_to_clean_md.py"), str(p1), str(out8),
         "--no-figures", "--json"],
        capture_output=True, text=True,

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The open-ended dependency range does not constrain installations to a reviewed release, allowing dependency behavior and security properties to change without a manifest change. This is a supply-chain hardening weakness rather than evidence of a compromised package, but it matters for a library processing potentially untrusted PDFs.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

# PyMuPDF is AGPL-3.0 licensed. `import pymupdf` exists from 1.24; older
# releases expose the same API as `fitz` and are supported via a fallback.
pymupdf>=1.23

Unverifiable Dependency: pymupdf has 2 known advisory(ies) (CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py); CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.

Content

No source excerpt is available for this finding.