pdf

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.0.0

Overview

This is a coherent PDF-processing skill, but it should be reviewed because it includes password-removal, sensitive form-filling, image extraction, and in-place repair workflows without enough safety and data-handling guidance.

Install only if you are comfortable with a local PDF utility that can read, transform, decrypt, and write documents. Use it only on PDFs you own or are authorized to process, keep form data and generated images in a private working directory, delete sensitive intermediates when done, and avoid in-place repair commands unless you have a backup.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Hidden Instructions

High

• Category: Prompt Injection

Content

---
name: pdf
version: 1.0.0
description: "Process PDF files �� read, merge, split, rotate, watermark, create, fill forms, encrypt/decrypt, OCR"

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide explicitly documents use of qpdf to decrypt password-protected PDFs and remove protection, but it provides no warning that this should only be done on documents the user owns or is authorized to process. In an agent skill context, operational examples often become automated actions, so omission of authorization guidance can facilitate misuse against protected documents.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill directs creation of `field_values.json` files and filled PDFs that are likely to contain personally identifiable and potentially sensitive form data, but gives no guidance on secure handling, storage, or cleanup of those artifacts. In agent or shared-workspace environments, these files can persist on disk, be indexed, logged, synced, or exposed to other users and tools, creating an avoidable confidentiality risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow for non-fillable forms creates annotated PDFs plus page images and cropped image regions that may contain full document contents and entered personal data, yet the skill omits any privacy or retention warning. These image artifacts broaden exposure because they can capture entire pages, signatures, identifiers, and handwritten content, and are often easier to leak through caches, thumbnails, backups, or shared folders.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This markdown file contains operational guidance for decrypting PDFs and removing password protection, which can affect document confidentiality and access controls. The surrounding text presents the commands as routine examples but does not warn users about the sensitivity, authorization requirements, or privacy implications of processing protected files.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The `qpdf --replace-input corrupted.pdf` command performs an in-place write to the source PDF, which can directly alter the user's original file. The markdown does not disclose this destructive behavior or suggest backing up the file first, so users may not realize the integrity risk.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This code performs a file write to the user-supplied output path, which can affect user data, but the operation has no confirmation prompt and no comment or docstring warning about the write behavior. The only user-facing message is a usage string, which does not disclose that the script will generate or overwrite the specified output file.

Static analysis

No suspicious patterns detected.