Pdf2word Skills

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:44 AM UTC
• Version: 1.0.0

Overview

This PDF conversion skill has a coherent purpose, but it downloads and later runs an unverified OCR executable and offers remote OCR without clear privacy and secret-handling warnings.

Install only if you are comfortable running a downloaded third-party OCR executable without built-in checksum verification. Prefer the default local engine for confidential PDFs. If using Gemini, assume document contents may be sent to the provider and store the API key with owner-only permissions or a safer secret manager.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.sh:28

Finding

Remote Executable Downloaded Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Python Dependency Is Not Fully Pinned or Hash-Verified

Content

View full analysis

=1.1.0 ``` ### Technical Analysis The open-ended version constraint permits any future `python-docx` version satisfying `>=1.1.0`. It therefore does not guarantee that users install the version reviewed and tested with this project. Dependency resolution may also select different transitive dependency versions over time. No lock file or package hashes are provided. Package integrity consequently depends on the package index and transport trust at installation time rather than a project-controlled allowlist of reviewed artifacts. ### Attack Path 1. A future compatible package or transitive dependency release becomes compromised, malicious, or unexpectedly unsafe. 2. A user runs `pip install -r scripts/requirements.txt`. 3. The resolver selects the affected release because it satisfies the open-ended version constraint. 4. Package-controlled installation or runtime code executes in the user's Python environment. 5. The affected dependency can operate with the privileges of the user running installation or document conversion. ### Impact Assessment A compromised dependency could execute code during installation or when imported by `pdf2word.py`. Potential impact includes access to files and credentials readable by the current user, modification of generated DOCX files, disclosure of document contents, and compromise of the active Python environment. The project does not directly install the dependency with elevated privileges, so impact is normally limited to the privileges used for `pip` and script execution. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39

Finding

Gemini API Key Is Stored Without Explicitly Restrictive Permissions

Content

View full analysis

~/.ocr/config ``` ### Technical Analysis The documented configuration procedure writes a Gemini API key as plaintext and does not explicitly set restrictive permissions on either the directory or configuration file. The effective permissions depend on the user's current `umask`. On systems with permissive defaults, shared accounts, unusual home-directory permissions, backup exposure, or other local users, the credential may be readable by parties other than its owner. The key also remains persistently stored after OCR processing. ### Attack Path 1. A user follows the documented Gemini setup commands. 2. The user's `umask` or local configuration permits broader access than intended. 3. The API key is written to `~/.ocr/config` in plaintext without an explicit owner-only mode. 4. Another local user or process with filesystem access reads the configuration file. 5. The attacker uses the copied key to submit API requests under the victim's account or quota. ### Impact Assessment Exploitation can expose the Gemini API credential and permit unauthorized API consumption, quota depletion, financial charges where billing applies, and activity attributed to the credential owner. The key grants only the permissions assigned by the remote provider; this finding does not demonstrate operating-system privilege escalation. ]]>

Remediation

View remediation

"$HOME/.ocr/config" ``` 3. Prefer an operating-system credential store or a short-lived environment-based secret injection mechanism. 4. Avoid including real keys in shell history; use an interactive prompt or secure secret-management tool. 5. Document credential revocation and rotation procedures. 6. Warn users that Gemini mode transmits document content to a remote service and may have privacy, retention, or compliance implications. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pdf2word.py:40

Finding

Predictable Temporary Output Path Enables File-Race and Symlink Attacks

Content

View full analysis

Converting extracted text to Word Document ({output_docx})...") doc = Document() with open(temp_text_file, "r", encoding="utf-8") as f: ``` ```python finally: # Cleanup temporary text file try: if os.path.exists(temp_text_file): os.remove(temp_text_file) except OSError as e: print(f"Warning: Could not remove temporary file {temp_text_file}: {e}") ``` ### Technical Analysis The temporary OCR output name is deterministically derived by appending `.txt` to the user-supplied output path. The script does not securely create the file, ensure exclusive ownership, reject symbolic links, or verify that the object read and removed is the same regular file produced by the OCR process. In a shared writable directory, another local process can predict the path and create or replace it between the existence check, read, and cleanup operations. The exact clobbering behavior during OCR output depends on how the external `docr` executable opens its output path. Independently of that behavior, the Python code remains exposed to content substitution and time-of-check/time-of-use races. ### Attack Path 1. A victim selects an output path in a directory writable by an attacker. 2. The attacker predicts the temporary name as `.txt`. 3. The attacker pre-creates that path or races ...[truncated 938 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly instructs users to send scanned PDF contents to a remote OCR engine (Gemini API) but does not warn that document data may leave the local machine and be processed by a third party. Because scanned PDFs often contain sensitive personal, legal, financial, or business information, this omission can cause inadvertent privacy, confidentiality, or compliance exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 44)May include surrounding context.

To use Gemini, first configure your API key:

bash

mkdir -p ~/.ocr
echo "gemini_api_key=your_gemini_key" > ~/.ocr/config

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README encourages use of the Gemini engine for OCR but does not disclose that document contents will be transmitted to a third-party API. In a PDF-to-Word skill, users may process sensitive scanned documents, so omission of this data-flow warning creates a meaningful privacy and compliance risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The instructions store a long-lived API key in a predictable path under ~/.ocr/config without any guidance on file permissions or safer secret-handling options. While this is common documentation behavior rather than overtly malicious logic, it can expose credentials to other local users, backups, shell history, or accidental disclosure depending on system configuration.

Content

Scanner excerpt · README_zh.md (reported line 39)May include surrounding context.

要使用 Gemini，请先配置您的 API 密钥：

bash

mkdir -p ~/.ocr
echo "gemini_api_key=your_gemini_key" > ~/.ocr/config

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documentation describes capabilities that require shell execution and file access, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a mismatch between what the skill can induce an agent to do and what reviewers or policy controls can validate, increasing the risk of overbroad execution or unexpected file access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill recommends use of a remote OCR engine (Gemini) but does not clearly warn that document contents may be transmitted to a third-party service. Users may unknowingly send sensitive scanned documents, including personal, financial, or regulated data, outside the local environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The instructions store a Gemini API key in a persistent config file under ~/.ocr, which leaves credentials on disk beyond the current session. Persistent secrets increase exposure to later compromise through local account access, backups, accidental inclusion in support bundles, or other processes reading user home-directory files.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

To use Gemini, first configure your API key:

bash

mkdir -p ~/.ocr
echo "gemini_api_key=your_gemini_key" > ~/.ocr/config

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The installer fetches a prebuilt executable from a remote release URL and immediately places it on disk and marks it executable, but it performs no integrity or authenticity verification such as a pinned checksum or signature check. If the release asset, GitHub account, network path, or upstream distribution process is compromised, users may install and later execute a trojanized binary through this skill's setup flow.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/pdf2word.py (reported line 42)May include surrounding context.

python

try:
        # Pass extra custom arguments to docr
        cmd = [docr_path, input_pdf, "-o", temp_text_file] + extra_args
        subprocess.run(cmd, check=True)
    except subprocess.CalledProcessError as e:
        print(f"Error: OCR extraction failed: {e}")
        sys.exit(1)

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency is specified as python-docx>=1.1.0, which allows installation of any future release and does not guarantee reproducible or reviewed builds. This increases supply-chain risk because a later vulnerable or malicious version could be pulled in unexpectedly, and it also makes it hard to verify whether the environment is using a safe release.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

python-docx>=1.1.0

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

python-docx has known historical advisories related to XML external entity handling, and because the manifest does not pin the version, there is no way to verify from this file alone whether the installed release is patched. In a PDF/Word conversion skill that processes user-supplied documents, document-parsing libraries are security-sensitive, so uncertainty around a potentially vulnerable parser is more dangerous than in a non-document-processing context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.