only for test

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 1.0.0

Overview

This document extraction skill is mostly purpose-aligned, but its read-only framing conflicts with broad command/write permissions, unsafe temporary PDF image files, and under-described OCR data handling.

Install only if you are comfortable granting broad local command and file-write authority to a document extraction skill. Avoid using it on confidential scans or screenshots unless you know how the OCR MCP service handles data, and prefer running dependency installs in a dedicated virtual environment. Scanned PDFs may leave page images in /tmp unless the workflow is fixed to use private temporary files and cleanup.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:59
• Finding: Unpinned Runtime Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:59-71` **Vulnerability Type**: Supply-chain exposure through unpinned Python dependencies **Risk Level**: Medium ```bash pip install python-docx openpyxl pymupdf ``` ### Technical Analysis The Skill instructs users to install three packages without exact version pins, integrity hashes, a lockfile, or an isolated environment. Although minimum versions are documented separately, the installation command resolves the latest matching packages from the configured Python package index. This makes the effective code installed at runtime mutable after the Skill has been reviewed. Security depends on the integrity of the package registry, index configuration, package maintainers, and all transitive dependencies. ### Attack Path 1. An attacker compromises a listed package, one of its transitive dependencies, or the package index used by the environment. 2. The victim follows the documented installation command. 3. `pip` resolves and installs the attacker-controlled release. 4. Malicious installation hooks or imported package code execute under the victim's account when the dependency is installed or the Skill processes a document. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running `pip` or invoking the Skill. This may expose local documents, credentials accessible to that account, and other files within the account's permission scope. If installation is performed with elevated privileges, the impact could extend to system-wide compromise.
• Remediation: ## Remediation Suggestions - Pin every direct and transitive dependency to a reviewed version. - Use a lockfile or constraints file generated from a trusted environment. - Require package hashes, such as through `pip install --require-hashes`. - Install dependencies inside a dedicated, non-privileged virtual environment. - Configure an approved package index and disable untrusted supplemental indexes. - Add automated dependency vulnerability and integrity scanning. - Upgrade packages through a controlled review process rather than resolving mutable versions during Skill execution.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:17
• Finding: Read-Only Skill Grants General Command and File-Write Capabilities## Vulnerability Details **File Location**: `SKILL.md:17` **Vulnerability Type**: Excessive tool permissions and violation of least privilege **Risk Level**: High ```yaml allowed-tools: Read, Grep, Glob, Write, Bash, mcp__zai-mcp-server__extract_text_from_screenshot ``` ### Technical Analysis The Skill is defined as a read-only document extraction utility, but its configuration authorizes unrestricted `Write` and `Bash` tools. General shell execution and file modification are substantially broader than the legitimate requirements of reading documents and returning extracted Markdown. Because documents are attacker-controlled input, their extracted contents may contain prompt-injection instructions. If such content is mistakenly treated as agent instructions, the pre-authorized `Bash` and `Write` capabilities provide a direct path from untrusted document text to local command execution or file modification. ### Attack Path 1. An attacker creates a supported document containing instructions intended to manipulate the agent after extraction. 2. A victim asks the Skill to process the document. 3. The parser or OCR service returns the attacker-controlled instructions as document text. 4. The agent incorrectly treats those instructions as operational commands rather than untrusted data. 5. The agent invokes `Bash` or `Write` to execute commands, alter files, or access resources unrelated to document extraction. ### Impact Assessment Exploitation could execute commands and modify files with the privileges of the agent process. The accessible scope may include the project workspace, user-owned files, environment variables, credentials available to subprocesses, and network resources reachable from the host. No privilege elevation beyond the agent process's operating-system account is demonstrated, but the granted capabilities exceed the Skill's stated purpose.
• Remediation: ## Remediation Suggestions - Remove general `Bash` and unrestricted `Write` permissions. - Replace them with narrowly scoped document-parsing operations. - If temporary writes are necessary, permit writes only within a private temporary directory. - Prohibit command execution derived from document contents or OCR results. - Explicitly mark all extracted text as untrusted data that cannot modify Skill instructions. - Require confirmation for operations outside extraction and formatting. - Run parsers in a sandbox with restricted filesystem access, no unnecessary network access, resource limits, and a non-privileged account.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:117
• Finding: Predictable Temporary Filenames for Rendered PDF Pages## Vulnerability Details **File Location**: `SKILL.md:117-125` **Vulnerability Type**: Unsafe temporary-file creation and sensitive-data retention **Risk Level**: Medium ```python for i, page in enumerate(doc, 1): text = page.get_text().strip() if text: # Text-based PDF extraction else: # Render scanned PDF page for OCR pix = page.get_pixmap(dpi=150) pix.save(f"/tmp/pdf_page_{i}.png") # Invoke the configured MCP OCR tool ``` ### Technical Analysis Rendered PDF pages are written to predictable global paths such as `/tmp/pdf_page_1.png`. The filenames contain no random component, and the instructions do not create a private directory, verify file ownership, reject symbolic links, apply restrictive permissions, or remove the images after OCR. In a shared environment, concurrent processes can collide with these filenames. A local attacker may pre-create a file or symbolic link at the expected path. Depending on the image library's file-opening behavior and operating-system permissions, this could cause denial of service, overwrite an attacker-selected file, or expose rendered document contents. Even without active exploitation, omitted cleanup may leave sensitive page images available after processing. ### Attack Path 1. A local attacker predicts that the first scanned page will be written to `/tmp/pdf_page_1.png`. 2. The attacker monitors that path or pre-creates a conflicting file or symbolic link. 3. The victim processes a scanned PDF. 4. The Skill writes the rendered page to the predictable path. 5. The attacker reads the retained page, disrupts extraction, or attempts to redirect the write to another location permitted by the victim's account. ### Impact Assessment The primary impact is disclosure of potentially confidential PDF content to other local users or processes. Additional impacts may include extraction failures, cross-process data corruption, ...[truncated 152 chars]
• Remediation: ## Remediation Suggestions - Create a private temporary directory with `tempfile.TemporaryDirectory`. - Generate unpredictable filenames instead of using page numbers in a shared directory. - Set restrictive permissions so only the current process or user can read rendered pages. - Prevent symbolic-link following and use exclusive file creation where supported. - Delete every rendered page immediately after OCR and guarantee cleanup with a `finally` block or context manager. - Avoid retaining rendered images in logs, caches, or output artifacts. - Isolate each extraction request in a separate temporary directory to prevent concurrent-job collisions.

other

Warning

• Location: SKILL.md:44
• Finding: Document Images Are Sent to an OCR Integration Without a Defined Trust Boundary## Vulnerability Details **File Location**: `SKILL.md:44-55` **Vulnerability Type**: Potential sensitive-document disclosure to an externally managed OCR integration **Risk Level**: Medium ```text Tool: mcp__zai-mcp-server__extract_text_from_screenshot Parameters: image_source: image path or URL prompt: extraction instruction programming_language: optional code language ``` ### Technical Analysis The Skill requires an MCP OCR tool for images and scanned PDF pages. The documentation does not define whether processing is local or remote, identify the resolved service endpoint, state retention and logging policies, describe authentication controls, or require informed user consent before document images cross that integration boundary. MCP is an integration mechanism rather than a guarantee of local processing. Supplying a local path may permit the integration to read the referenced image, while remote implementations may transmit the image or extracted content to another service. Confidentiality therefore depends on infrastructure that is not described or constrained by the Skill. ### Attack Path 1. A victim requests extraction from a confidential image or scanned PDF. 2. For a scanned PDF, the Skill renders the page to an image. 3. The image path or image content is supplied to the configured MCP OCR integration. 4. The integration processes, transmits, logs, or retains the content according to policies not disclosed in the Skill. 5. An operator, compromised integration, or downstream service may gain access to the document content. ### Impact Assessment The potential impact is disclosure of all visible content in submitted images or scanned PDF pages, including personal data, business records, source code, credentials shown in screenshots, or regulated information. The exact destination and retention scope cannot be determined from the audited file, so external transmission is a trust-boundary risk rather ...[truncated 49 chars]
• Remediation: ## Remediation Suggestions - State whether OCR is performed locally or remotely and identify the responsible service. - Display the resolved endpoint and data-handling policy before processing. - Obtain explicit user consent before transmitting document images outside the local environment. - Document retention, logging, encryption, authentication, and deletion policies. - Provide a local-only OCR option for confidential material. - Minimize transmitted data by cropping or redacting unnecessary regions. - Reject public URLs or untrusted OCR destinations unless explicitly authorized. - Ensure temporary page images are removed after processing and are not retained by default.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The PDF OCR workflow explicitly saves rendered page images to disk despite the documentation claiming the skill does not create or modify files. This inconsistency undermines trust boundaries and may expose sensitive document content through residual temporary files left on the system.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill is presented as 'read-only', but its documented behavior includes writing intermediate OCR image files and directing the agent to install packages. This mismatch can mislead users and policy layers about the skill’s actual side effects, increasing the chance of unintended filesystem changes or environment modification during use.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Allowing Write conflicts with the skill’s declared read-only purpose and permits creation or modification of local files. Even if intended only for OCR intermediates, this creates an avoidable capability that could be abused for persistence, tampering, or data leakage staging.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Allowing Write conflicts with the skill’s declared read-only purpose and permits creation or modification of local files. Even if intended only for OCR intermediates, this creates an avoidable capability that could be abused for persistence, tampering, or data leakage staging.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The OCR path sends image paths or URLs and potentially document-derived content to an external MCP service without a clear user-facing warning or consent step. For sensitive documents, this can result in unintended third-party disclosure of confidential data, which is a meaningful privacy and security risk.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: Natural-language instructions, triggers, parameters, workflow, and errors are all presented in Chinese, which effectively forces a specific language for users of the skill. There is no opt-in language choice or explanation that the skill is intended only for a Chinese-speaking or region-specific context.

Static analysis

No suspicious patterns detected.