doc-reader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:55 AM UTC
• Version: 1.0.0

Overview

The document reader is mostly local and understandable, but it includes a separate persistent learning logger that stores notes and preferences outside the core document-reading purpose.

Review this skill before installing if you will process sensitive documents. Use the document extractor only on files you are allowed to process, avoid putting document content or private details in learner notes, and consider disabling or removing learner.py unless you specifically want persistent local learning records. Install dependencies in an isolated environment with pinned versions where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-26
Vulnerability Type: Unpinned dependencies installed from the default package index
Risk Level: Medium

Vulnerable Code

markdown

| .pdf | `pypdf` / `PyPDF2` | `pip install pypdf` |
| .docx | `python-docx` | `pip install python-docx` |

Technical Analysis

The installation instructions direct users or automated agents to install third-party Python packages without fixed versions, cryptographic hashes, or a dependency lock file. Consequently, pip resolves whatever package version and transitive dependencies are available from the configured package index at installation time.

Although the referenced package names appear legitimate, the installation process does not guarantee that users receive versions reviewed by the project author. A compromised upstream release, package-index account, distribution artifact, or transitive dependency could introduce malicious code after this Skill has been audited.

Python packages may execute arbitrary code during installation or when imported by scripts/doc_extract.py. Therefore, dependency integrity must be established before package installation and execution.

Attack Path

1. An attacker compromises an upstream package release, its publishing account, or one of its transitive dependencies.
2. A user or agent follows the documented pip install pypdf or pip install python-docx instruction.
3. Because no version or artifact hash is specified, pip resolves and downloads the currently available compromised distribution.
4. Attacker-controlled code executes during package installation or when doc_extract.py imports and uses the dependency.
5. The payload operates with the privileges and environmental access of the user running pip or the document extraction script.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the ...[truncated 476 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed dependency manifest containing exact versions, such as:

   text

   pypdf==<reviewed-version>
   python-docx==<reviewed-version>
   

2. Generate and verify cryptographic hashes for every direct and transitive dependency, then install with:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Use a lock-generation tool such as pip-tools to resolve and pin the complete transitive dependency graph.

4. Retrieve packages only from an explicitly trusted package index or an internally controlled artifact repository.

5. Review and update locked dependencies through a controlled process that includes vulnerability scanning and provenance verification.

6. Avoid installing dependencies with elevated privileges, and run document extraction in an isolated environment with access limited to the required input and output files.

7. Update SKILL.md so its installation examples reference the locked and hash-verified dependency file rather than unconstrained package names.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The manifest describes a local document-reading utility, but the documentation also exposes a persistent self-learning subsystem that records notes, failures, and reflections to disk. This is a significant behavior mismatch because users may grant trust for passive document parsing while the skill also performs stateful data collection and persistence, which can capture sensitive content or operational metadata outside the declared purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements a generic cross-skill learning/telemetry component, which is materially outside the declared purpose of a local document-reading skill. Because it can resolve arbitrary skill directories and persist usage/error history there, it introduces hidden data collection and cross-skill statefulness that users would not reasonably expect from a document parser.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises executable scripts that read and write local files, but it does not declare any explicit tool scope or permissions boundary. That makes the operational trust boundary unclear and increases the chance an agent or user invokes file-capable behavior more broadly than intended, especially in environments that rely on manifest-declared restrictions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description, title, tags, and the rest of the skill instructions are written entirely in Chinese, which effectively constrains use to a specific language without any opt-in or alternative locale guidance. Under the policy, language-specific behavior should either offer a choice or clearly justify the locale limitation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

A persistent self-learning feature inside a document reader creates an undeclared storage channel for potentially sensitive document-derived notes, errors, and usage history. In the context of a skill intended to process contracts, resumes, and reports, this increases privacy and data-retention risk because information can remain on disk beyond the immediate task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file embeds its module description, CLI help text, and status messages entirely in Chinese, which imposes a specific language experience on users. The file does not offer any language/locale option or explain that the skill is intended only for a Chinese-speaking or region-specific environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code records user preferences, capabilities used, error types, and free-form notes into a persistent JSON file, despite the skill being described as a document-reading utility. Those notes and preferences may contain sensitive document-derived content or user behavior metadata, creating an unnecessary privacy and data-minimization risk if the feature is invoked silently or without retention controls.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The safety boundary frames the skill as read-only with respect to authorized documents, but elsewhere the documentation acknowledges writing extracted results and learned memory to disk. This inconsistency can mislead users about data handling and may cause them to expose sensitive files under the assumption that no local persistence occurs beyond transient processing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.