PDF助手

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:26 AM UTC
• Version: 1.0.0

Overview

This PDF tool is not clearly malicious, but it sends user documents to TinyWow with unclear retention terms and includes an exposed API key in its documentation.

Review this skill before installing. Do not use it for confidential, regulated, financial, legal, identity, or proprietary documents unless TinyWow and the payment/API-key arrangement are acceptable to you. The publisher should remove and rotate the exposed key, add an explicit pre-upload consent step, and make the retention policy consistent.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:20
• Finding: Hardcoded API Credential Exposed in Skill Documentation## Vulnerability Details **File Location**: `SKILL.md:20` **Vulnerability Type**: Hardcoded secret **Risk Level**: High ### Vulnerable Code ```markdown - **API Key**: `sk_3bf4e74479614724623768f5269c68251b09adf555a891eda68dbdfeac108f01` ``` ### Technical Analysis A secret-shaped API key is stored directly in a project file distributed with the Skill. Documentation files are not an appropriate secret-storage mechanism because every user, package registry, source-control mirror, build artifact, and automated scanner with access to the Skill can retrieve the credential. If the credential is active, possession may be sufficient to authenticate requests as its owner. The Skill does not implement user-specific credential isolation, runtime secret injection, or controls preventing other parties from copying and reusing the key. ### Attack Path 1. An attacker downloads or otherwise obtains access to the Skill package. 2. The attacker opens `SKILL.md` and extracts the hardcoded API key. 3. The attacker identifies the service or payment API accepting the credential. 4. The attacker submits requests authenticated with the exposed key. 5. Those requests consume the owner's quota or balance and appear under the credential owner's identity until the key is revoked or restricted. ### Impact Assessment If valid, the credential could permit unauthorized use of the associated service. Potential effects include fraudulent paid requests, balance or quota depletion, service disruption through resource exhaustion, and loss of request attribution. The exact privileges cannot be established because the repository does not document the key's permissions or provide executable integration code.
• Remediation: ## Remediation Suggestions 1. Revoke and rotate the exposed credential immediately; deleting it from the current file does not invalidate copies that may already exist. 2. Remove the credential from the current package and all source-control history, published releases, caches, and build artifacts. 3. Supply credentials at runtime through a protected secret manager or environment variable rather than embedding them in Skill documentation. 4. Use separate, user-specific credentials instead of a shared project-wide key. 5. Apply least-privilege scopes, usage limits, expiration, service restrictions, and billing alerts to replacement credentials. 6. Add automated secret scanning to development and release workflows to prevent future publication. 7. Review service logs and billing records for unauthorized use of the exposed key.

other

Warning

• Location: SKILL.md:63
• Finding: Ambiguous Third-Party File Disclosure and Retention Claims## Vulnerability Details **File Location**: `SKILL.md:63-79` **Vulnerability Type**: Unclear third-party data handling and inconsistent retention disclosure **Risk Level**: Medium ### Vulnerable Code ```markdown ## 处理流程 1. 用户上传需要处理的文件 2. 系统将文件提交至处理平台 3. 完成处理后返回结果文件给用户 4. 所有文件处理完成后自动清理，保护隐私 ## 注意事项 - 单个文件大小限制：10MB - 每次最多处理5个文件 - 处理时间根据文件大小和网络情况可能需要等待 - 所有上传文件会在24小时后自动删除 ## 数据来源 使用 [TinyWow](https://tinywow.com/) 进行文件处理 - 免费在线文件处理工具。 ``` ### Technical Analysis The documented workflow sends user-provided files to the external TinyWow service. These files may contain personal data, credentials, financial records, contracts, proprietary material, or other confidential information. The retention statements are internally ambiguous. One statement says that files are automatically cleaned up after processing, while another says uploaded files are automatically deleted after 24 hours. The documentation does not explain which system retains the data, when deletion actually occurs, whether temporary copies or backups exist, or whether TinyWow independently retains or processes associated metadata. The Skill also does not require explicit user approval immediately before transferring a file to the external provider. Because no implementation is included, the deletion and privacy claims cannot be technically verified from the audited project. ### Attack Path 1. A user asks the Skill to process a confidential PDF or office document. 2. Based on the cleanup statement, the user assumes that the file will be deleted immediately after processing. 3. The workflow transfers the document to TinyWow, an external service. 4. The document or related metadata remains under third-party control for an unclear period, potentially up to at least 24 hours according to the conflicting statement. 5. Any compromise, unauthorized access, policy mismatch, or unintended retention at the provider could expose the submitted informa ...[truncated 617 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit, informed user consent immediately before transmitting a file to TinyWow. 2. Clearly state that processing occurs on an external service and provide links to the applicable privacy policy and terms. 3. Replace the conflicting cleanup statements with one verified retention policy that distinguishes local temporary files, provider-side files, metadata, logs, caches, and backups. 4. Do not promise automatic deletion unless the implementation verifies successful provider-side deletion. 5. Warn users not to submit passwords, identity documents, regulated records, trade secrets, or other sensitive data unless the provider and workflow have been formally approved. 6. Minimize transmitted data, use encrypted transport, avoid unnecessary metadata, and apply strict access controls to temporary files. 7. Prefer local processing or a contractually governed provider for confidential documents. 8. Document the responsible data controller or processor, processing locations, subprocessors, incident procedures, and deletion mechanism.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill says files are submitted to a processing platform and later identifies TinyWow as the backend, but it does not present a clear upfront warning that user documents are sent to a third-party service. This is dangerous because users may upload sensitive files without understanding that their data leaves the primary environment and is subject to external retention and handling practices.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: All user-facing instructions, examples, and descriptions are written in Chinese, and the document does not indicate that the skill is region-specific or that users may choose another language. This can violate language/locale policy when a specific language is effectively forced without opt-in or justification.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are very broad and generic, such as simple requests to convert, merge, or split files, without clear activation boundaries or confirmation requirements. This increases the chance of unintended invocation and accidental transmission of user files to the skill or its downstream service.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation makes conflicting retention claims: one section says files are automatically cleaned after processing, while another says uploads are deleted after 24 hours. For a file-processing skill handling potentially sensitive documents, inconsistent privacy and retention statements can mislead users about exposure duration and weaken informed consent.

Static analysis

No suspicious patterns detected.