PDF Processor

• Outcome: Review
• Latest audit: May 29, 2026 · 9:31 PM UTC
• Version: 2.0.0

Overview

This PDF skill mostly does what it says, but it should be reviewed because it can start a local Ollama service in the background and mutates local PDF files without an explicit confirmation step.

Install only if you are comfortable with a local Python workflow that reads PDF contents, writes translations and summaries, moves the original PDF into a completed folder, deletes temporary extraction files, stores progress in plaintext while running, and may start Ollama in the background. Use a dedicated folder, back up important originals first, and start or manage Ollama yourself before processing sensitive documents.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("\n🚀 正在启动Ollama服务...")

    try:
        subprocess.Popen(['ollama', 'serve'],
                     stdout=subprocess.DEVNULL,
                     stderr=subprocess.DEVNULL)
        time.sleep(5)

• Confidence: 90% confidence
• Finding: subprocess.Popen(['ollama', 'serve'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly describes capabilities to read and write local files, invoke shell commands, and communicate with a local network service, yet no permissions are declared. This creates a trust and containment problem: users or the hosting platform cannot accurately understand or constrain what the skill can do, and the undocumented capabilities include file modification and command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented purpose is PDF processing, but the skill also describes additional behaviors such as indexing processed papers, moving original files, managing checkpoint files, and potentially starting a local Ollama service. Even if these behaviors are not overtly malicious, the mismatch reduces informed consent and can hide side effects that matter for privacy, data integrity, and local system changes.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill description says it extracts, detects language, translates, and summarizes PDFs, but the code also moves the original PDF and deletes the intermediate extracted-text file. This mismatch is security-relevant because users may not expect file mutation or deletion from a processing skill, increasing risk of accidental data loss or workflow disruption.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Automatically starting a local model server and creating a child process exceeds the advertised scope of a simple PDF-processing skill. Even though it targets a local dependency, this introduces execution behavior that operators may not authorize and can bypass expectations about what the skill is allowed to do.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger phrases are broad enough that the skill may activate on vague requests like '处理PDF' or when files appear in a directory, without a clear boundary on scope or confirmation. Overbroad activation can cause unintended processing of sensitive documents or unexpected file operations, especially because this skill also modifies, moves, and deletes files.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents automatic movement of PDFs, deletion of temporary extracted text, and cleanup of progress files, but does not present these as risky file-modifying operations requiring explicit warning or consent. In a local document-processing context, silent file changes can lead to accidental data loss, broken workflows, and mishandling of sensitive research documents.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script moves the source PDF and deletes an intermediate file without explicit confirmation, backup prompt, or dry-run mode. In a file-processing skill, silent modification of user data is dangerous because mistakes, path confusion, or interrupted workflows can cause data loss or make files hard to locate.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill sends extracted document content to a local HTTP service without clearly warning the user that full text is being transmitted to another process. Even though the endpoint is localhost, this is still inter-process data exposure and may leak sensitive academic, proprietary, or personal document contents to logs, plugins, or other local users depending on system configuration.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The resume/progress feature stores translated text and processing state in plaintext JSON under the working directory, and the script also writes extracted document text to disk elsewhere. For sensitive PDFs, this creates persistent local copies that may outlive the main workflow and be accessible to other users, backups, or indexing tools.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.