pdf-online

• Outcome: Review
• Latest audit: Aug 24, 2026 · 7:20 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent document-to-cloud publishing adapter, but it deserves review because some routes automatically write to external accounts and fetch arbitrary image URLs from the agent environment.

Install only if you intend the agent to create or modify Feishu, DingTalk, or Notion content using your logged-in platform accounts. Review source documents and any explicit SoMark JSON/Markdown pairs first, because image URLs in those artifacts may be fetched from the agent's network environment and then uploaded into the target platform.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill advertises substantial capabilities and delegates to platform-specific modules, yet no explicit permissions are declared at the entry point despite requiring environment access, file operations, networking, and shell/tool execution. This weakens least-privilege enforcement and reviewability, making it easier for downstream modules or future changes to use powerful capabilities without clear user or platform oversight.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 72% confidence
• Finding: The skill description and top-level routing logic do not cleanly match the broader behavior implied by the available adapters and utilities, which can cause reviewers and users to misunderstand what actions may occur. Description-behavior drift is dangerous because it can hide unexpected publication paths, data transformations, or external destinations, increasing the chance of unintended data disclosure or unsafe execution.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code fetches attacker-controlled HTTP(S) image URLs during sheet enhancement and then re-uploads the retrieved content into DingTalk. Even though it blocks embedded credentials, checks content type/extensions, and enforces a size limit, it still grants the skill a network-fetch capability that can be abused for SSRF-style access to internal services, unexpected outbound requests, and transfer of untrusted remote content through the host environment.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code performs remote side effects against DingTalk (`doc create`, `doc block update`, readback/repair flows) as soon as `execute=True`, and it does not enforce an explicit in-function confirmation, dry-run gate, or user-facing acknowledgment before creating or modifying documents. In an agent/skill context, that is dangerous because a caller, prompt, or upstream workflow can trigger external writes and post-processing updates with real account authority, leading to unintended publication or modification of remote content.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: This file silently downloads remote images and later uploads them to DingTalk without any explicit user-facing disclosure or consent path in the execution flow. In a document conversion/publishing skill, hidden network retrieval and onward transmission of referenced resources can surprise users, leak access patterns or sensitive URLs, and increase the risk of unintended data movement.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to perform a remote Feishu import immediately and not pause for confirmation before creating or modifying external resources. That creates a real security and safety issue because unreviewed content may be uploaded to third-party services, causing unintended data exfiltration, privacy exposure, or unauthorized writes under the user's account.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

existing Base or supplies a Base URL/token as the destination. Do not reuse a
recent Base merely because it is available.

Do not ask the user to confirm headers, field mapping, or a destination Base
before SoMark parsing. After a successful SoMark JSON result exists, treat its
HTML `table.content` as the sole source of truth for Bitable headers. Never
open, render, screenshot, visually inspect, or run another OCR pass on the

• Confidence: 84% confidence
• Finding: The instruction to avoid asking the user to confirm headers, field mapping, or destination behavior before parsing encourages autonomous decisions that can lead to incorrect schema inference and unintended writes. In this context, the danger is amplified because the workflow can create and populate remote Bitable resources based on inferred structure without a human validation checkpoint.

Static analysis

No suspicious patterns detected.