use_pdf

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:05 AM UTC
• Version: 1.0.0

Overview

This is a coherent PDF-processing skill with expected local file reads and writes, but users should handle sensitive PDFs and generated outputs carefully.

Install only if you are comfortable with a PDF utility that can read documents and create local derivative files. Use it on PDFs you are authorized to process, avoid running overwrite commands on originals, prefer a virtual environment with pinned dependencies, and delete temporary images or JSON files that contain sensitive form data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:235

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:235
Vulnerability Type: Unpinned third-party package installation
Risk Level: Low

Vulnerable Code

python

# Requires: pip install pytesseract pdf2image

Technical Analysis

The Skill instructs users to install pytesseract and pdf2image directly from the configured Python package index without specifying reviewed versions, cryptographic hashes, or a locked dependency manifest. Package names are resolved to whichever versions are available at installation time, so the installed code can differ from the code available when the Skill was audited.

The package names do not appear to be typographical imitations, and the instruction does not specify an untrusted custom package index. Therefore, this finding does not establish that either named package is malicious. The risk arises from mutable dependency resolution: compromise of an upstream package, one of its transitive dependencies, the configured package index, or a future release could introduce code that executes during installation or later import.

Attack Path

1. A user follows the OCR instructions in SKILL.md.
2. The user runs pip install pytesseract pdf2image without version or hash restrictions.
3. pip resolves the latest compatible packages and transitive dependencies from the configured package index.
4. An attacker who has compromised an upstream release, dependency, package-maintainer account, or package-distribution channel supplies a malicious artifact.
5. The malicious package code executes during installation or when the PDF workflow imports the package.

This exploitation path depends on an upstream or distribution-channel compromise; no malicious dependency payload is present in the audited repository.

Impact Assessment

Malicious dependency code would ordinarily execute with the privileges of the account running pip or the resulting Python process. It could rea ...[truncated 345 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the inline unversioned installation command with a reviewed dependency manifest containing exact versions.
2. Generate and record cryptographic hashes for every direct and transitive dependency.
3. Require hash verification during installation:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Periodically review and deliberately update pinned versions rather than resolving new releases automatically.
5. Install dependencies in an isolated virtual environment under a non-privileged account.
6. Use a trusted package index or an internally controlled artifact repository, and prohibit unexpected fallback indexes.
7. Add automated dependency vulnerability and integrity scanning to the release process.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a clear mismatch. The declared description promises broad PDF-file operations, but the code chunk only performs geometric validation on form field bounding boxes loaded from a JSON input. Its primary purpose is quality checking layout metadata, not handling PDFs directly. None of the major advertised PDF capabilities are present in this code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description claims a general-purpose PDF skill covering many operations, but this code chunk implements only one specific function: rasterizing PDF pages into PNG images. While this is PDF-related, it is not explicitly one of the listed capabilities. The actual behavior does not match the breadth of the declared purpose, and its primary purpose is image conversion rather than the described set of PDF operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk does not implement any of the declared PDF-related capabilities such as reading PDFs, extracting text/tables, merging/splitting PDFs, OCR, or form filling. Instead, it performs a distinct task: visual validation of form field bounding boxes by drawing rectangles onto an image using coordinates from a JSON file. While this could be part of a larger PDF form-processing pipeline, the actual behavior shown here is materially different from the broad declared purpose and relies on image and JSON inputs rather than direct PDF operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This is a description-behavior mismatch because the declared purpose presents the skill as a broad all-purpose PDF tool, while the supplied code chunk performs a specific and narrower task: extracting PDF form field structure and positional metadata into JSON. Although this behavior is PDF-related and somewhat adjacent to 'filling PDF forms,' it is not the same as filling forms, nor is form-field metadata extraction explicitly mentioned in the description. The primary purpose of the code is specialized introspection of PDF form fields rather than the broad set of PDF operations claimed by the description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence

Finding

The skill demonstrates file read/write capabilities through example code and command usage, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can let a broadly-triggered skill access or modify local files without clear policy constraints, increasing the chance of unintended data exposure or file tampering.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation rule says to use the skill whenever the user wants to do anything with PDF files or merely mentions a .pdf file, which is extremely broad. In an automated agent pipeline, that can cause unnecessary invocation of a file-capable skill in contexts where the user did not intend document processing, increasing the risk of accidental access, transformation, or disclosure of PDF contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide includes password-removal and decryption commands without any warning that they should only be used on documents the user is authorized to access. In a skill intended for autonomous assistance, normalizing decryption steps without guardrails can facilitate bypass of document protections or encourage handling of protected material without verifying legitimacy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs exporting full-page images from PDFs, which can expose all visible document contents including sensitive text, signatures, identifiers, or embedded records. Without a warning about the privacy implications of generating image derivatives and cropped regions, users may create extra persistent copies of confidential material that are easier to share or leak than the source PDF.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs creation of field_values.json and filled PDFs that may contain sensitive personal or regulated data, but it provides no warning about local persistence, access controls, or cleanup. Users or downstream agents may leave PII in plaintext JSON and derivative PDFs on disk, increasing the risk of unintended disclosure through logs, backups, shared workspaces, or artifact retention.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes PDF operations such as reading, extracting, filling, OCR, and related transformations, but these instructions additionally direct use of external shell commands (magick/convert) as part of the workflow. Spawning external image-processing tools is not an obvious or declared capability of a PDF skill at the manifest level, and it broadens the operational surface beyond the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown reference includes commands and code that write new files, replace existing files, extract document contents, and remove password protection, such as fs.writeFileSync, writer.write, qpdf --decrypt, and qpdf --replace-input. The document presents these as ready-to-run examples but does not warn users that these actions may alter files, expose sensitive PDF contents, or overwrite inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script performs a file write to the user-supplied output path, which is a safety-relevant operation for code files. While the action is functionally expected for a PDF-filling utility, this file itself provides no confirmation prompt, comment/docstring disclosure, or user-facing notice beyond the CLI usage line.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.