Security audit

pdfly-cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent PDF helper, but its signing instructions can expose certificate passwords or private keys and its install command pulls an unpinned package.

Review the signing instructions before installing or using this skill. Prefer a pinned, trusted pdfly version, avoid passing certificate or PDF passwords directly in commands, do not export private keys with unencrypted OpenSSL options for verification, and keep backups or explicit output files when modifying PDFs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned Third-Party Package Installation and Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/sign.md:24
Finding: PKCS12 Password Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/sign.md:93
Finding: Private Signing Key Exported Without Encryption
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill recommends running uvx pdfly without pinning a specific version, which allows whatever latest package version is available at execution time to be fetched and run. That creates a supply-chain risk: a malicious or compromised upstream release could be executed through the skill, and the skill context makes this more relevant because it is explicitly providing an installation/execution command users may copy directly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation includes an in-place signing example that modifies the original PDF without an explicit warning that the operation overwrites the source file. In a CLI skill intended for file manipulation, this increases the chance of accidental irreversible data loss, especially if users run examples verbatim on important documents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The example passes the PKCS12 password directly on the command line, which can expose the secret via shell history, process listings, audit logs, or telemetry. Because this skill handles signing certificates, credential exposure is more dangerous than in ordinary tooling: compromise of the certificate password may enable unauthorized document signing or key extraction depending on environment and key handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The markdown documents a signing command using a PKCS12 certificate (--p12 CERT) but does not include any warning that the operation involves sensitive credential material. For markdown files, safety-relevant behaviors affecting privacy or credentials should be disclosed so users understand the implications before use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file documents operations that create output files and can split, merge, remove, or reorder PDF pages, which affect user data and system state. The description and options explain how to perform these actions but do not warn users about potential overwrites, data loss, or the need to choose a safe output path.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.