pdf-processing

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:25 AM UTC
• Version: 1.0.0

Overview

This is a simple PDF-processing skill with disclosed dependencies and no hidden execution, persistence, credential access, or bundled code.

Install the dependencies in a virtual environment, avoid running pip or PDF processing as an administrator, and confirm before using the skill to modify or merge documents because those actions change user files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-26
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

markdown

## Dependencies

Requires installation of pdfplumber:
```bash
pip install pdfplumber pypdf

text

### Technical Analysis

The installation command retrieves `pdfplumber`, `pypdf`, and their transitive dependencies without fixed versions, cryptographic hashes, a lockfile, or an explicitly trusted package index. Consequently, the dependency graph is mutable and may differ between installations.

This creates a supply-chain risk if a future release or transitive dependency is compromised. Package installation or subsequent imports may execute attacker-controlled Python code with the privileges of the user running `pip` or invoking the PDF-processing functionality.

### Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, or the package-distribution channel.
2. The attacker publishes a malicious version that remains compatible with the unconstrained installation request.
3. A user follows the documented `pip install pdfplumber pypdf` command.
4. The package resolver selects and installs the malicious release.
5. Attacker-controlled code executes during installation or when the dependency is imported and used.

This path requires compromise of a dependency or its distribution chain; the audited project itself does not contain an embedded malicious payload.

### Impact Assessment

Successful exploitation could execute arbitrary code under the account performing installation or PDF processing. The attacker could access files and environment variables available to that account, modify user-owned data, make network requests, or tamper with processed documents. System-wide impact would be possible if the installation or later execution occurred with elevated privileges.

No evidence of credential theft, persi
...[truncated 115 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed version, for example pdfplumber==X.Y.Z and pypdf==A.B.C.
• Generate and commit a lockfile that includes resolved transitive dependencies.
• Require cryptographic hashes during installation, such as with pip install --require-hashes -r requirements.txt.
• Configure installation to use an explicitly trusted package index and disable unintended supplemental indexes.
• Regularly scan dependencies for known vulnerabilities and review updates before changing pinned versions.
• Install dependencies in an isolated virtual environment under a non-privileged account.
• Avoid running pip or PDF-processing operations with administrator or root privileges.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill metadata and content are written in Chinese, which may bias or force interactions toward a specific language without confirming the user's preference. In multi-user or multilingual agent settings, this can lead to confusion, misinterpretation of operations on documents, and reduced transparency around potentially sensitive file-processing actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition '当需要对 PDF 文件进行操作时使用此技能' is very broad and can cause the skill to be invoked for nearly any PDF-related request, even when a narrower or safer tool would be more appropriate. Over-broad activation increases the chance of unintended file handling, unnecessary dependency use, and surprising behavior in agent workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.