T08 · Insecure Dependencies
Warning
- Location
SKILL.md:5- Finding
Unpinned Third-Party Executable Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
Paper To Markdown
Security checks for vulnerabilities and agentic risk
Overview
This PDF-to-Markdown skill is purpose-aligned and disclosed, but users should know it sends PDFs to MinerU's online service and installs an external CLI.
Install only if you are comfortable sending selected PDFs or PDF URLs to MinerU for conversion. For sensitive, private, regulated, or client documents, require explicit confirmation before use and prefer a pinned or sandboxed CLI install where possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill’s activation guidance is broad enough to match common user requests like reading, summarizing, or analyzing a PDF, which can cause the skill to trigger in situations where users may not expect their document or link to be sent to a third-party API. This is especially sensitive because the skill explicitly supports local files and URLs and its data flow states that documents are transmitted off-box for processing.
- Content