Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it uploads a user-selected document to PaodingAI/PDRouter to convert it to Markdown, so the main consideration is data privacy for sensitive files.
Install only if you are comfortable sending the selected document contents to PaodingAI/PDRouter for processing. Avoid using it on confidential, regulated, or proprietary documents unless your organization approves that service, and prefer a pinned or otherwise verified package source when installing.
The skill description and behavior do not prominently warn that local files are transmitted to an external API service for processing. This is dangerous because users or higher-level agents may treat the operation as a local conversion and unknowingly disclose confidential document contents, credentials, regulated data, or proprietary material to a third party.
The manifest instructs use of an external API with Bearer authentication for local PDF, DOCX, PPT, or image files, but provides no user-facing warning that local file contents will be transmitted off-system. In a document-processing skill, this is especially dangerous because uploaded files often contain sensitive business, legal, financial, or personal information, making accidental exfiltration to a third party a significant confidentiality risk.
The skill invokes a Node.js script that uses environment variables and makes outbound network requests, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. This weakens policy enforcement and reviewability, making it easier for the skill to access sensitive inputs or exfiltrate local document contents without clear upfront disclosure or restriction.
The installation instruction uses an unpinned npx skills add PaodingAI/skills, which can fetch whatever package/version is current at execution time. This creates a supply-chain risk where a compromised upstream release or namespace change could deliver different code than was reviewed.
The skill is eligible for many broad document-processing tasks, including generic retrieval, extraction, and downstream analysis. Because the workflow uploads a local file to an external API, over-broad routing criteria increase the chance the agent sends sensitive documents off-host when a less invasive local method might have sufficed.
The default prompt says to "Always execute" the bundled script for one local document, creating a broad auto-activation behavior not clearly scoped to explicit user consent. This can cause the agent to transmit local files to an external service during loosely related tasks, increasing the risk of unintended data disclosure and surprise tool execution.
Detected: suspicious.env_credential_access
