Web to PDF

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:09 AM UTC
• Version: 1.0.0

Overview

This PDF-conversion skill has a coherent purpose, but its implementation exposes high-impact risks that should be reviewed before installation.

Review before installing. Use this only in a sandbox or other low-trust environment, only with trusted public URLs, and only with simple user-chosen output filenames until the shell invocation, URL restrictions, temp-file handling, and dependency pinning are fixed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/capture.mjs:276

Finding

Shell Command Injection via User-Controlled Output Path

Content

View full analysis

/tmp/wtpdf-proof).pdf ``` 3. `parseArgs()` assigns the value to `opts.output`. 4. `assemblePDF()` interpolates the value into the command string. 5. The shell evaluates the command substitution when `execSync()` runs. 6. The injected command executes with the same operating-system privileges as the skill process. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the skill. The attacker could read or modify files accessible to that account, access environment variables and credentials, execute network requests, tamper with generated artifacts, or use any other permissions available to the process. The scope is the host or container in which the skill ...[truncated 90 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/capture.mjs:302

Finding

Unrestricted Browser Navigation Enables Internal-Network and Local-Resource Access

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/capture.mjs:158

Finding

Predictable Shared Temporary Files Permit Symlink Attacks and Cross-Run Collisions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/package.json:6

Finding

Unpinned and Non-Reproducible Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description explains the PDF conversion behavior but omits a warning that it opens arbitrary URLs in a headless browser and will make outbound network requests to remote sites. Because this tool targets untrusted web content and executes client-side page logic during rendering, the missing disclosure makes the capability more dangerous in agentic use and can lead to unexpected privacy, SSRF-like, or tracking exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx playwright install chromium without pinning a specific Playwright version. Using an unpinned package in install instructions can fetch whatever version is current at execution time, which weakens reproducibility and increases supply-chain risk if a malicious or compromised release is published.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The invocation examples are broad enough that an agent may trigger this skill for generic requests like "Save this web page as PDF" or "Export this presentation to PDF." In this skill's context, activation causes arbitrary URLs to be loaded in a headless browser, which can generate unintended external network access and execution of untrusted page JavaScript.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The prerequisites section again references npm install playwright && npx playwright install chromium without a pinned version. Repeating unpinned install guidance broadens the chance that users will pull an unexpected or compromised upstream release, creating a supply-chain exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description contains broad trigger phrases like converting any pasted URL to PDF or handling generic requests such as 'save as PDF' and 'export this', which can cause the skill to activate on common requests without making the network-fetching and file-writing behavior explicit. Over-broad activation increases the chance of unintended execution against attacker-controlled URLs or surprising local file creation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documentation does not clearly warn that it will retrieve remote content in a browser context and write the resulting PDF to local storage. In this context, that omission matters because rendering arbitrary URLs can expose the environment to untrusted web content, while local file output can overwrite or create files in unexpected locations if not clearly confirmed with the user.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to run npx playwright install chromium without pinning a version, which can fetch and execute tooling from whatever version is current at install time. This creates a supply-chain and reproducibility risk: a malicious or compromised upstream release could run arbitrary install-time code on the local machine.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a caret range (^1.50.0), which permits installation of newer compatible releases instead of a single audited version. In a security-sensitive automation tool that fetches and renders arbitrary web content, this weakens reproducibility and can unexpectedly introduce vulnerable or malicious package versions through normal installs.

Content

Scanner excerpt · scripts/package.json (reported line 7)May include surrounding context.

json

"private": true,
  "type": "module",
  "dependencies": {
    "playwright": "^1.50.0"
  }
}

Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 85% confidence

Finding

The manifest uses an unpinned Playwright dependency while Playwright has a known advisory related to downloading/installing browsers without verifying authenticity. Because the version is not pinned, it is not possible to determine from this manifest whether deployed environments may resolve to an affected release, and this skill's purpose—automated browser-based capture of remote web pages—makes browser supply-chain integrity more important than usual.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/capture.mjs:289