Pdf Filler

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:05 AM UTC
• Version: 0.1.5

Overview

This skill is a coherent PDF form-filling helper, with ordinary but real caution around installing an unpinned third-party package and returning filled PDFs that may contain sensitive data.

Before installing, consider pinning oc-pdf-filler and its dependencies in a locked environment. Use the skill only with PDFs and form data you are comfortable processing in the agent workspace, and confirm the attachment destination when the filled PDF may contain personal, financial, medical, legal, or business-sensitive information.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned and Unaudited Runtime Dependency Executes Outside the Reviewed Codebase

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:47-53, scripts/extract.py:10-17, scripts/fill.py:12-19, and scripts/list_backends.py:6-13
Vulnerability Type: Third-party software supply-chain exposure
Risk Level: Medium

Vulnerable Code

SKILL.md:47-53:

bash

## Setup (once per workspace)

The skill scripts call the `oc-pdf-filler` Python package. Install it first:

```bash
pip install "oc-pdf-filler[all]"
# or, if working from the source repo: pip install -e ".[all]"

text

`scripts/extract.py:10-17`:

```python
try:
    from oc_pdf_filler.cli import main
except ImportError:
    sys.stderr.write(
        "oc-pdf-filler is not installed.\n"
        "Install it with: pip install 'oc-pdf-filler[all]'\n"
    )
    sys.exit(2)

scripts/fill.py:12-19:

python

try:
    from oc_pdf_filler.cli import main
except ImportError:
    sys.stderr.write(
        "oc-pdf-filler is not installed.\n"
        "Install it with: pip install 'oc-pdf-filler[all]'\n"
    )
    sys.exit(2)

scripts/list_backends.py:6-13:

python

try:
    from oc_pdf_filler.cli import main
except ImportError:
    sys.stderr.write(
        "oc-pdf-filler is not installed.\n"
        "Install it with: pip install 'oc-pdf-filler[all]'\n"
    )
    sys.exit(2)

Technical Analysis

The supplied project does not contain the implementation of oc_pdf_filler. Its executable scripts are thin wrappers that import and invoke oc_pdf_filler.cli.main, while the documentation directs users to install the package and all optional dependencies from the configured Python package index.

The dependency is not pinned to an exact audited version, no package hashes are supplied, and no lockfile or verified artifact is included. The [all] extra can also expand the set of installed transitive dependencies. As a result, the code executed by this Skill may differ over time from the code that was reviewed.

This creates a software supply-chain risk. A compromised packa ...[truncated 1929 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin oc-pdf-filler to a specific version that has been independently audited, for example by using an exact == constraint rather than an unconstrained package name.
2. Generate and commit a dependency lockfile containing exact versions for all direct and transitive dependencies.
3. Require cryptographic hashes during installation, such as with a hash-locked requirements file and pip install --require-hashes.
4. Vendor the required implementation into the reviewed project or include the complete source as a verifiable submodule so executable behavior is available during audits.
5. Separate optional backends into explicitly selected dependency groups rather than installing [all] by default.
6. Build dependencies in an isolated environment and install from an approved internal package repository or signed artifact store.
7. Run PDF processing in a least-privilege sandbox with restricted filesystem access, no unnecessary credentials, and outbound network access disabled unless explicitly required.
8. Add automated dependency scanning, release provenance verification, and a controlled update process that requires review before dependency versions change.
9. Document the exact expected package version and checksum in SKILL.md, and ensure all wrapper error messages recommend the same verified installation command.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

Step 2: Build a values JSON file

The fill input is a flat JSON object { "FieldName": value }. Example:

json

{

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to autonomously send the filled PDF back to the user without asking for confirmation. That bypasses an important consent checkpoint and can cause unintended disclosure of sensitive personal or regulated data contained in filled forms, especially in chat integrations or shared channels.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

Procedure:

1. Read `output_path` from the fill summary. It is guaranteed to be inside the workspace, so the host can attach it.
2. Use whatever attachment / file-return mechanism the host provides — Telegram bot `sendDocument`, Slack `files.upload`, the agent runtime's own `attach_file` / `send_file` tool, or simply emit it as a workspace artifact. Do not ask the user "do you want me to send it?"; just send it.
3. In the same turn, briefly confirm what was sent (filename + filled-field count). The user shouldn't have to ask twice.
4. If you genuinely cannot find an attachment channel, surface the workspace-relative path so the user can fetch it manually — but treat that as a last resort.

Static analysis

No suspicious patterns detected.