T09 · Insecure Skill Coding Practices
Warning
- Location
- skill.json:15
- Finding
- Obsolete RC4 Encryption Is Offered for PDF Protection## Vulnerability Details **File Location**: `skill.json:15` and `SKILL.md:8` **Vulnerability Type**: Use of an obsolete cryptographic algorithm **Risk Level**: Medium **Affected code snippets:** `skill.json:15` ```json { "name": "encryption", "type": "string", "required": false, "default": "aes256", "enum": ["aes256", "aes128", "rc4"], "description": "Encryption algorithm" }, ``` `SKILL.md:8` ```markdown Encrypts a PDF with password protection. Supports AES-256 (default), AES-128, and RC4-128 encryption. Allows setting separate user and owner passwords with granular permission controls. ``` ### Technical Analysis The skill explicitly permits users to select RC4 for PDF encryption. RC4 is a deprecated stream cipher with known cryptographic weaknesses and is not appropriate for protecting confidential documents. Although AES-256 is the default, the accepted `rc4` configuration allows callers to produce documents with materially weaker protection. The weakness does not grant local system privileges or provide direct code execution. Exploitation requires access to a PDF that was protected using the RC4 option. The practical severity also depends on the PDF encryption revision, password strength, and the attacker's access to the encrypted file. ### Attack Path 1. A user or integrating application explicitly sets the `encryption` field to `rc4`. 2. The external PDF service generates a document using obsolete RC4-based protection. 3. The resulting encrypted PDF is distributed, stored, intercepted, or otherwise obtained by an attacker. 4. The attacker identifies the PDF encryption configuration and applies password-recovery or cryptanalytic tooling targeting legacy PDF and RC4 protection. 5. If the protection is defeated, the attacker can access the PDF contents despite the user's expectation of strong encryption. ### Impact Assessment Successful exploitation can compromise the confidentiality of the affected PDF ...[truncated 295 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `rc4` from the accepted encryption enumeration in `skill.json`. 2. Remove all documentation that advertises RC4 support. 3. Retain AES-256 as the default and preferred algorithm. 4. Permit AES-128 only when legacy compatibility is necessary and clearly document that limitation. 5. Enforce the algorithm allowlist on the server side rather than relying only on client metadata. 6. Reject requests specifying `rc4` with a clear validation error. 7. Add automated tests confirming that obsolete algorithms cannot be selected. 8. Review previously generated RC4-protected documents and re-encrypt sensitive files using AES-256 with strong, unique passwords.