PDFlux Test

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:06 AM UTC
• Version: 1.0.3

Overview

The skill is a disclosed document-to-Markdown workflow that uploads a user-selected file to PaodingAI's service and does not show hidden, destructive, or unrelated behavior.

Install only if you are comfortable uploading selected documents to PaodingAI/PDRouter and providing a PD_ROUTER_API_KEY. Prefer a pinned or verified install source if available, and avoid sending confidential documents unless that service is approved for your data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Remote Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–17
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx skills add PaodingAI/skills

Technical Analysis

The documented installation command invokes npx without pinning the skills package to a specific audited version. Depending on the local environment and cache state, npx may retrieve and immediately execute the latest package version from the configured package registry.

The PaodingAI/skills source reference is also not pinned to an immutable commit or content digest. Consequently, both the installer implementation and installed repository content may change after this audit. The project provides no lockfile, integrity hash, signature verification procedure, or immutable revision in the installation command.

This creates a supply-chain risk: compromise of the package publisher, registry account, package namespace, upstream repository, or a future malicious release could cause code not covered by this audit to execute during installation.

Attack Path

1. An attacker compromises the publisher account, package namespace, configured registry, or referenced upstream source.
2. The attacker publishes or substitutes a malicious version while retaining the expected package or repository name.
3. A user follows the installation command in SKILL.md.
4. npx resolves mutable remote content because no version or integrity constraint is specified.
5. The downloaded installer runs malicious code with the privileges of the user executing the command.
6. The malicious installer could access files and credentials available to that user, alter installed Skill content, or execute additional commands.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope would include files, environm ...[truncated 411 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills package to a specific audited version rather than relying on the latest registry release.
• Pin PaodingAI/skills to an immutable commit hash or signed release tag.
• Use a lockfile and package-manager integrity metadata where applicable.
• Verify package signatures or cryptographic checksums before executing downloaded code.
• Document the expected package registry and trusted upstream repository to reduce dependency-confusion risk.
• Prefer installing dependencies in a restricted environment with least privilege and without unnecessary production credentials.
• Establish a controlled update process in which new installer and Skill revisions are reviewed before updating pinned versions.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly requires environment access to read PD_ROUTER_API_KEY and performs outbound network requests to upload user-specified local files, but it does not declare any tool scope such as permissions or allowed-tools. This creates a governance gap: a runtime or reviewer cannot clearly constrain or audit the skill's sensitive capabilities, increasing the risk of unintended file exfiltration or over-broad execution in agents that rely on manifest-level permission declarations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

Using npx skills add PaodingAI/skills without a pinned version allows installation of whatever package version is current at execution time. If the upstream package is compromised, replaced, or publishes a malicious update, users may fetch and execute unreviewed code, resulting in supply-chain compromise before the skill's own safeguards apply.

Content

No source excerpt is available for this finding.