Pdf Form Filler

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:18 AM UTC
• Version: 0.2.0

Overview

This skill is a straightforward PDF form filler that reads user-specified forms and data, then writes filled PDF outputs.

Use this skill only on PDFs and data files you intend to process, write outputs to new filenames or a dedicated output directory, and consider pinning or reviewing the pdfrw dependency before installing in a sensitive environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Creates Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Locations:

• requirements.txt:1
• setup.py:22-24
• README.md:25-29

Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

Vulnerable Code

requirements.txt:1

text

pdfrw>=0.4

setup.py:22-24

python

install_requires=[
    "pdfrw>=0.4",
],

README.md:25-29

markdown

2. Install pdfrw:
   ```bash
   pip install pdfrw
   ```

Technical Analysis

The project installs pdfrw without an exact version, upper version boundary, package hash, or lock file. The constraint allows the package resolver to install any release from version 0.4 onward, including future releases that were not reviewed by the project maintainers.

The documentation also instructs users to install the latest package resolved under the name pdfrw, without identifying a trusted package index or providing integrity verification. Consequently, dependency resolution is mutable and builds are not reproducible.

This does not demonstrate that the current pdfrw release is malicious. The vulnerability is the project's implicit trust in any future matching artifact. A compromised maintainer account, package-index compromise, or malicious future release could introduce attacker-controlled installation or runtime code.

Attack Path

1. An attacker compromises the upstream package, its publishing account, or the package distribution channel.
2. The attacker publishes a malicious pdfrw release whose version satisfies pdfrw>=0.4.
3. A user installs this project, runs pip install -r requirements.txt, or follows the documented pip install pdfrw instruction.
4. The package resolver selects and downloads the malicious release because no exact version or integrity hash is enforced.
5. Attacker-controlled dependency code executes during installation, import, or PDF processing with the privileges of the installing or ...[truncated 672 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the open-ended dependency constraint with an exact, reviewed version:

   text

   pdfrw==0.4
   

2. Generate a hash-locked requirements file using a dependency-management tool such as pip-tools, Poetry, or an equivalent mechanism:

   text

   pdfrw==0.4 \
       --hash=sha256:<verified-package-hash>
   

3. Install production dependencies with hash verification:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Retain the exact runtime version in the lock file even if setup.py uses a compatibility range for library consumers.
5. Configure builds to use an explicitly trusted package index and prevent fallback to untrusted indexes.
6. Review release provenance, package signatures where available, maintainer changes, and dependency diffs before updating the pinned version.
7. Run dependency installation and PDF processing inside a least-privileged virtual environment or isolated container.
8. Add automated dependency scanning and a controlled update process so security fixes can be adopted without silently accepting arbitrary future releases.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documentation describes reading local PDF files and enumerating their form fields, which implies file-read capability, but the skill metadata declares no explicit tool scope or permissions. This creates an authorization ambiguity: an agent or reviewer cannot tell what filesystem access is intended, increasing the risk of over-broad file access or accidental use on sensitive documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file contains multiple examples that write output PDF files such as "application_filled.pdf" and similar paths, but the documentation does not warn users that running the examples will create or potentially overwrite files on disk. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or system integrity; file writes are one of the listed operations to check.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a lower bound only (pdfrw>=0.4), which permits installation of any future release, including versions that may introduce security regressions, breaking changes, or supply-chain risk. In a document-processing skill, this can matter because PDF libraries operate on complex untrusted file formats and a vulnerable parser could expose the environment to denial of service or code-execution issues if a bad version is resolved.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pdfrw>=0.4

Static analysis

No suspicious patterns detected.