Pdf Batch Compress Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:25 AM UTC
• Version: 1.0.0

Overview

This PDF compression skill appears purpose-aligned, but it can overwrite many original PDFs with lossy replacements without backups, dry-run, or confirmation.

Review this carefully before installing. Use it only on copies or with your own backups, because it can replace original PDFs and PyMuPDF fallback may rasterize pages, reducing quality, searchability, and accessibility. Prefer pinning dependencies and changing logs/temp files to a private directory before running it on sensitive document sets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:57

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/batch_compress.sh:24

Finding

Predictable Shared Temporary Directory Exposes Document Paths and Compression Logs

Content

View full analysis

"$FILE_LIST" 2>/dev/null ``` `scripts/batch_compress.sh:125-127`: ```bash tr '\n' '\0' < "$FILE_LIST" | xargs -0 -P "$PARALLEL" -I {} \ "$PYTHON" "$GS_SCRIPT" "{}" "$THRESHOLD_MB" \ 2>&1 >> "$GS_LOG" || true ``` `scripts/batch_compress.sh:151-153`: ```bash tr '\n' '\0' < "$REMAINING_LIST" | xargs -0 -P "$PARALLEL" -I {} \ "$PYTHON" "$PYMUPDF_SCRIPT" "{}" "$THRESHOLD_MB" \ 2>&1 >> "$PYMU_LOG" || true ``` ### Technical Analysis The script uses a fixed, shared path under `/tmp` and creates it with `mkdir -p` without setting a restrictive `umask`, verifying directory ownership, or checking whether the path was pre-created by another local user. The generated filenames are based only on a timestamp and are therefore predictable. The file lists contain absolute paths to the user's PDF documents. Compression logs also contain document paths, original and compressed sizes, statuses, and exception details. Depending on the host's default permissions and `/tmp` behavior, other local users may be able to read these files. A locally pre-created directory can also cause denial of service or manipulation of where log data is written when ownership and path type are not validated. ### Attack Path 1. An attacker with acce ...[truncated 1036 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/compress_single.py:93

Finding

Best-Effort Logic Can Replace an Original PDF with an Unverified Candidate

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If part of the shipped skill primarily parses logs and generates reports rather than compressing PDFs as the description suggests, that is still a trust and transparency problem. While less severe than silent destructive writes, capability mismatch can lead operators to grant shell access or run the skill under incorrect assumptions about what actions will occur.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

If part of the shipped skill primarily parses logs and generates reports rather than compressing PDFs as the description suggests, that is still a trust and transparency problem. While less severe than silent destructive writes, capability mismatch can lead operators to grant shell access or run the skill under incorrect assumptions about what actions will occur.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If part of the shipped skill primarily parses logs and generates reports rather than compressing PDFs as the description suggests, that is still a trust and transparency problem. While less severe than silent destructive writes, capability mismatch can lead operators to grant shell access or run the skill under incorrect assumptions about what actions will occur.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If part of the shipped skill primarily parses logs and generates reports rather than compressing PDFs as the description suggests, that is still a trust and transparency problem. While less severe than silent destructive writes, capability mismatch can lead operators to grant shell access or run the skill under incorrect assumptions about what actions will occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown describes a batch compression workflow and notes that failed files are rendered as image PDFs, but it does not warn users about the practical impact on their documents. This behavior can materially affect document usability, such as increasing lossiness or changing text/search characteristics, and should be disclosed in the skill description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly instructs users to run shell commands and local scripts, yet it declares no permissions or allowed-tools scope. That makes the operational capability broader and less auditable, increasing the chance an agent executes filesystem-modifying shell actions without clear consent boundaries. In this context, the skill performs batch file discovery, parallel execution, and in-place replacement, so missing tool scoping is materially relevant rather than cosmetic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states that compressed files replace originals while keeping the same filename, but it does not prominently warn that this is destructive or advise backups first. In a batch-processing context, this can cause irreversible loss of source documents or loss of metadata/searchability across many files at once if compression quality is unacceptable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script is explicitly designed to replace original PDF files after compression and provides no backup, dry-run mode, confirmation prompt, or explicit safety interlock before modifying user data at scale. In the context of batch processing with parallel execution, a user can unintentionally cause irreversible data loss or quality degradation across many files, making this a real safety issue even if not malicious.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code replaces the input file in place via shutil.move(tmp_path, filepath) after compression succeeds or in best-effort mode. Although it prints a status afterward, there is no pre-action confirmation, warning comment/docstring about overwriting the source file, or other user disclosure near the destructive file-write behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code replaces the user's input file with the compressed output via shutil.move(tmp_path, filepath). Although the script's purpose is compression, there is no user-facing warning in the code or usage text that the original file will be modified in place rather than writing a separate output file, which can affect user data irreversibly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

In the fallback path, the script writes a lossy rendered PDF and then moves it onto the original filepath. This is more safety-sensitive because the operation is explicitly a partial/best-effort result, yet the user is not warned in advance that the original document will be replaced by potentially degraded content.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compress_single_gs.py (reported line 29)May include surrounding context.

python

if not GS:
    # 尝试从 PATH 查找
    try:
        result = subprocess.run(["which", "gs"], capture_output=True, text=True)
        if result.returncode == 0:
            GS = result.stdout.strip()
    except Exception:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compress_single_gs.py (reported line 62)May include surrounding context.

python

cmd.append(f"-sOutputFile={output_path}")
    cmd.append(input_path)

    result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
    return result.returncode == 0

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script replaces the original PDF in place once compression succeeds, with no confirmation prompt, backup retention, or atomic recovery path visible to the user. In batch or automated use, this can cause irreversible data loss if output quality is unacceptable, the file is corrupted, or an unexpected path is supplied.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

All user-facing documentation in this file is presented in Chinese, with no indication that the skill supports other languages or that Chinese is a required locale for a region-specific use case. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The natural-language description, instructions, and examples are all presented in Chinese, and there is no note that the skill is Chinese-language only or that users can choose another language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script's descriptive docstring and usage context are presented in Chinese only, which can function as a user-facing language restriction. The policy calls for flagging language or locale constraints when the skill forces a specific language without offering user choice or documenting justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language instructions, description, and usage guidance are presented solely in Chinese. Under the stated policy, forcing a single language without opt-in or documented regional justification is a language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Natural-language guidance in the docstring is exclusively Chinese, including usage and behavior notes. Under the policy, forcing a specific language without opt-in or clear regional justification is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's natural-language interface, including the title, usage text, status messages, and completion output, is entirely in Chinese. This imposes a specific language on users without any opt-in, fallback, or documented justification that the skill is intended only for a Chinese-language environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.