Security audit

PDF Batch Processing Tool

Security checks across malware telemetry and agentic risk

Overview

This is a local PDF utility whose file access and dependencies fit its stated purpose, though users should treat untrusted PDFs carefully and note that some advertised features are not implemented.

Install only if you need local merge, split, rotate, or text-extraction workflows. Use an isolated Python environment, pin current patched dependency versions if possible, and avoid processing PDFs from untrusted sources without sandboxing or resource limits. Do not rely on the advertised image extraction or compression features unless the publisher adds matching scripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes reading and writing local files but does not declare any permissions, which creates a transparency and policy-enforcement gap. In an agent environment, undeclared file access can lead to processing unintended files, overwriting outputs, or bypassing user expectations about what the skill is allowed to touch.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pypdf>=3.0.0 Pillow>=10.0.0
Confidence: 95% confidence
Finding: The dependency is specified with only a lower bound, which allows newer unreviewed versions to be installed and makes builds non-reproducible. In a PDF-processing skill that handles untrusted files, this increases supply-chain and stability risk because a future vulnerable or breaking release of pypdf could be pulled in automatically.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pypdf>=3.0.0 Pillow>=10.0.0
Confidence: 98% confidence
Finding: Pillow is also unpinned, so installs may resolve to different versions over time, including versions with known security issues. Because this skill processes PDFs and may extract embedded images, image parsing occurs on potentially attacker-controlled content, making dependency drift more dangerous than in a low-risk utility.

Known Vulnerable Dependency: pypdf — 10 advisory(ies): CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks); CVE-2026-27628 (pypdf has a possible infinite loop when loading circular /Prev entries in cross-); CVE-2026-40260 (pypdf: Manipulated XMP metadata entity declarations can exhaust RAM) +7 more

Low

Category: Supply Chain
Confidence: 87% confidence
Finding: The requirement permits versions of pypdf that may include multiple documented denial-of-service issues such as infinite loops and memory exhaustion when parsing crafted PDFs. Given this skill's purpose is bulk PDF processing, it is directly exposed to attacker-supplied document structures, which makes parser vulnerabilities materially relevant.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

Category: Supply Chain
Confidence: 97% confidence
Finding: The requirement permits Pillow versions with serious published vulnerabilities, including arbitrary code execution and resource-consumption flaws. Since the skill extracts images from PDFs, it may cause Pillow to parse attacker-controlled image streams, creating a plausible path to code execution or service disruption.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.