PDFlux SaaS Markdown

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:16 AM UTC
• Version: 1.0.4

Overview

The skill is a disclosed document-to-Markdown uploader for PDRouter, with clear data-flow notes but some install and consent cautions.

Install from a pinned or trusted release when possible, and only run this skill on documents you are comfortable uploading to PaodingAI/PDRouter with your PD_ROUTER_API_KEY. Avoid using it automatically for confidential documents unless external SaaS parsing is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Remote Installation Chain

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–14
Vulnerability Type: Unpinned third-party installer and mutable remote repository
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Installation

```bash
npx skills add PaodingAI/skills

text

### Technical Analysis

The documented installation command uses `npx` without pinning the `skills` package to a reviewed version or integrity hash. Depending on the local npm environment, `npx` can retrieve and execute the currently published version of that package.

The command also identifies `PaodingAI/skills` without an immutable commit, release identifier, or verified digest. Consequently, the code installed or executed in the future may differ from the code reviewed in this audit. Compromise of the npm package, publisher account, repository account, or mutable upstream content could convert this installation path into a supply-chain execution vector.

This finding concerns the documented installation chain. The audited runtime script itself does not dynamically retrieve executable code.

### Attack Path

1. An attacker compromises the npm package, its publisher account, the referenced repository, or another relevant upstream distribution channel.
2. The attacker publishes or substitutes a malicious package version or repository revision.
3. A user follows the documented `npx skills add PaodingAI/skills` installation command.
4. `npx` retrieves and executes the unpinned installer, which then resolves mutable upstream skill content.
5. The attacker-controlled code executes with the privileges of the user performing the installation.

### Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The resulting scope may include access to files readable or writable by that user, environment variables and credentials available to the process, agent configuration, and any extern
...[truncated 246 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills installer to an explicitly reviewed version rather than allowing npx to resolve the latest available release.
2. Pin the PaodingAI/skills source to an immutable commit hash or cryptographically signed release.
3. Publish expected checksums or integrity metadata and verify them before installation or execution.
4. Use npm lockfiles and integrity fields where applicable to ensure reproducible dependency resolution.
5. Execute installation in a least-privileged, isolated environment without unrelated secrets.
6. Document a controlled upgrade process requiring security review before changing pinned versions or commits.
7. Where supported, use npx --no-install with a preinstalled, verified package to prevent implicit network retrieval during installation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill requires access to environment variables and makes outbound network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a governance gap: an agent or runtime may grant broader capabilities than users expect, increasing the chance of unintended file handling, credential use, or data exfiltration through the documented upload flow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The installation command uses npx skills add PaodingAI/skills without pinning an exact package or skill version. This introduces supply-chain risk because future package changes, compromise of the upstream package, or dependency drift could cause users to install different code than the reviewed version.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The 'When to Use' section activates the skill for broad requests such as wanting to 'retrieve specific document content' or when later work merely depends on document content. These conditions are expansive and lack clear exclusion boundaries, which could cause the skill to be invoked for many ordinary document tasks where this specific upload-and-convert workflow may not be intended.

Content

No source excerpt is available for this finding.