Logics-Parsing阿里文档解析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:28 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent document-parsing guide, but its setup asks users to run mutable third-party code and handle potentially sensitive documents without enough safety guidance.

Review before installing. Use a pinned, reviewed Logics-Parsing commit and locked dependency versions, avoid running the setup with elevated privileges, and process confidential contracts, invoices, financial reports, or regulated documents only in an approved isolated environment with clear output-retention rules.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:95

Finding

Unpinned Remote Repository, Dependencies, and Download Scripts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 95–122
Vulnerability Type: T03: Remote Payload Retrieval and Execution, T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

# 1. Clone repository
git clone https://github.com/alibaba/Logics-Parsing.git
cd Logics-Parsing

# 2. Create environment (Python 3.10)
conda create -n logics-parsing python=3.10
conda activate logics-parsing

# 3. Install dependencies
pip install -r requirements.txt

# 4. Download model (Modelscope)
pip install modelscope
python download_model_v2.py -t modelscope

# Or download from HuggingFace
pip install huggingface_hub
python download_model_v2.py -t huggingface

The alternative v1 instructions repeat the unsafe pattern:

bash

conda create -n logics-parsing python=3.10
conda activate logics-parsing
pip install -r requirements.txt

# Download model
python download_model.py -t modelscope

Technical Analysis

The instructions clone the default branch of an external Git repository without pinning it to a reviewed release or full commit hash. The effective content can therefore change after this Skill has been audited.

The instructions subsequently install the cloned repository's dependency set and execute its model-download scripts. Neither package versions nor cryptographic hashes are specified in this Skill. The separately installed modelscope and huggingface_hub packages are also unpinned. Python package installation may execute package-controlled build or installation logic, while the downloaded repository scripts execute directly with the user's privileges.

The artifact itself contains no executable scripts or demonstrated malicious payload. The issue is the transfer of trust to mutable upstream code, package releases, transitive dependencies, and model artifacts that are outside this audit's scope.

Attack Path

1. An attacker compromises the upstream repository, a package publisher account, a transitive dependency, ...[truncated 1162 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Git repository to a reviewed release and immutable full commit hash:

   bash

   git clone --branch <reviewed-tag> --depth 1 https://github.com/alibaba/Logics-Parsing.git
   cd Logics-Parsing
   test "$(git rev-parse HEAD)" = "<expected-full-commit-hash>"
   

2. Maintain a reviewed lock file containing exact direct and transitive dependency versions.

3. Require cryptographic package hashes, for example through a generated requirements file used with:

   bash

   python -m pip install --require-hashes -r requirements.lock
   

4. Pin modelscope, huggingface_hub, and all related packages to reviewed versions and hashes.

5. Document authoritative model artifact URLs, expected filenames, versions, sizes, and SHA-256 checksums. Verify every artifact before loading it.

6. Audit download_model_v2.py, download_model.py, dependency metadata, and installation hooks at the pinned commit before recommending their execution.

7. Run installation and inference in a least-privileged container or isolated account with restricted filesystem access, no unnecessary credentials, and controlled outbound network access.

8. Avoid running installation commands as root or with sudo, and publish a process for reviewing and intentionally updating pinned revisions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly targets contracts, financial reports, invoices, and other business documents, but it provides no warning about privacy, confidential data handling, retention, or network/model-download implications. This is dangerous because users may submit regulated or sensitive documents to a parsing workflow without understanding exposure risks, especially where outputs, logs, or model dependencies may involve external systems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger section uses very broad natural-language cues such as '解析这篇 PDF' and '将 PDF 转 HTML' without clear scope checks, consent requirements, or boundaries on when the skill should activate. In an agent environment, this can cause unintended invocation on arbitrary user-provided documents, increasing the chance of processing sensitive files or invoking heavyweight external tooling unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Across the file, all user-facing instructions and trigger descriptions are presented in Chinese, which can effectively force a specific language experience without opt-in. The document does not indicate that the skill is region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.