document-pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.1.0

Overview

This document-processing skill mostly does what it claims, but it also directs the agent to persist task activity in record.md without clear user consent or data limits.

Review this skill before installing if you may process confidential documents. The main concern is not the document parsing itself, but the automatic instruction to write task summaries and operation history to record.md; install only if you are comfortable with that persistence or can disable/remove it. Prefer pinned dependencies in a controlled environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:208

Finding

Unnecessary Persistent Recording of Task Activity

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 208-210
Vulnerability Type: Unnecessary Persistent Activity
Risk Level: Medium

Complete Code Snippet:

markdown

## 任务完成后

完成任务后，做任务总结，将操作记录更新到 record.md 中。

Technical Analysis

The skill requires the agent to update record.md with a task summary and operation history after completing each task. This persistent write is not necessary for the skill's stated document extraction and summarization purpose.

The instruction does not define user consent, data minimization, access controls, retention limits, or rules preventing sensitive document content from being recorded. Consequently, an implementation following this instruction could retain document names, extracted information, user requests, or operational context beyond the original session.

This behavior is classified as unnecessary persistent activity rather than agent memory poisoning because the reviewed instruction requests an operational record but does not explicitly write attacker-controlled behavioral rules into long-term agent memory.

Attack Path

1. A user provides a confidential document for processing.
2. The agent extracts or summarizes sensitive information from the document.
3. After completing the task, the skill directs the agent to write a summary and operation history to record.md.
4. Sensitive context is retained in persistent storage without an explicit retention or access-control policy.
5. A later user, process, or session with access to the same file may recover the retained information.

Impact Assessment

The issue does not directly grant elevated system privileges or code-execution capabilities. Its primary impact is confidentiality loss across tasks or sessions. The exposed scope depends on what the agent records and who can access record.md; it may include document metadata, user instructions, extracted content, and summaries of confidential fi ...[truncated 4 chars]

Remediation

View remediation

Remediation Suggestions

Remove the unconditional requirement to update record.md. If activity logging is operationally required:

1. Obtain explicit user consent before creating a persistent record.
2. Record only minimal, non-sensitive metadata.
3. Prohibit storage of document contents, extracted text, credentials, personal information, and confidential summaries.
4. Define a short retention period and automatic deletion procedure.
5. Store records in a location protected by least-privilege filesystem permissions.
6. Isolate records by user and session to prevent cross-user disclosure.
7. Allow users to inspect, disable, and delete stored records.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Third-Party Document-Processing Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-13
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

yaml

dependencies:
  python:
    - pdfplumber
    - pypdf
    - python-docx
    - python-pptx
    - openpyxl
    - pandas

Technical Analysis

All declared Python dependencies lack exact version constraints and integrity hashes. Dependency resolution can therefore select different releases over time, making installation non-reproducible and preventing the project from guaranteeing that the installed artifacts are the versions that were reviewed.

The dependency-check example elsewhere in SKILL.md also generates a pip install command without version constraints. If that command is used, the package installer resolves whatever versions are available from its configured index at installation time. This increases exposure to compromised upstream releases, unsafe future versions, dependency confusion through an untrusted package index, and transitive dependency changes.

The listed package names do not provide evidence of typosquatting or a presently malicious package. The risk arises from unconstrained resolution and the absence of artifact verification.

Attack Path

1. One or more document-processing dependencies are unavailable in the runtime.
2. The operator or agent installs the dependencies without version constraints.
3. The configured package index resolves an unreviewed, compromised, or otherwise unsafe current release or transitive dependency.
4. Package installation hooks or imported package code execute in the environment.
5. Malicious dependency code obtains the permissions of the installing or executing process and may access documents processed by the skill.

This path is conditional on a compromised dependency, unsafe package source, or vulnerable resolved release; no such compromise is directly demonstrated by the r ...[truncated 478 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a specifically reviewed version.
2. Generate and commit a lock file containing resolved transitive dependencies.
3. Require cryptographic hashes for downloaded distributions, such as with a hash-locked requirements file.
4. Install only from a trusted, explicitly configured package index.
5. Disable unintended fallback to public or user-controlled indexes.
6. Review transitive dependencies and scan the locked dependency set for known vulnerabilities.
7. Update the dependency-check example so its generated installation command uses the same pinned and hash-verified dependency manifest.
8. Perform installation and document processing in a sandbox with minimal filesystem and network permissions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger conditions are broad enough to activate on many ordinary document-related requests, increasing the chance that the skill runs when the user did not specifically intend to invoke it. Because the skill also contains side-effect behavior (record.md updates), broad triggering makes unintended file modification and data retention more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Step 4 explicitly says to summarize for the user in Chinese, which imposes a fixed language requirement. There is no indication that the user can choose the output language or that the Chinese-only behavior is limited to a justified region-specific use case.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a document extraction and summarization tool, but it additionally instructs the agent to update a persistent record.md after every task. This expands behavior beyond the declared scope and can create unauthorized file modifications and unintended retention of user-derived information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Adding persistent task logging to record.md is not justified by the skill's stated purpose of document processing. In a document-analysis context, this creates unnecessary data retention risk because summaries, filenames, extracted text, or processing notes may be written to disk without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs updating record.md after task completion without warning that a user file will be modified. Undisclosed writes are dangerous because they violate least surprise, can overwrite or pollute workspace files, and may persist sensitive information from processed documents.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This instruction can cause plain-language retention of sensitive document contents, filenames, extracted notes, or processing history in record.md. In a document-processing skill, that context makes the issue more dangerous because the inputs often include confidential reports, contracts, or internal materials, turning a convenience log into a privacy and data-handling problem.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is broad enough to trigger on generic requests to analyze, extract, or summarize documents, without clearly constraining when the skill should activate. Overbroad activation increases the chance of unintended invocation on routine user requests, which can expose document contents to unnecessary processing or cause the skill to operate outside its intended scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The natural-language description is written entirely in Chinese and presents the skill behavior in that locale without mentioning any ability to choose another language. This can indicate a language-policy issue when a skill appears to assume a specific language without user opt-in or documented locale scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.