Security audit

Nano PDF

Security checks for vulnerabilities and agentic risk

Overview

This PDF skill is not malicious, but it gives a very vague PDF helper broad command, file-writing, and network capabilities that need review before installation.

Review this skill before installing. It contains no evident malware or persistence, but its instructions are too vague for the broad tools it advertises. Use it only if you are comfortable with an agent potentially running shell commands, writing files, and accessing the web for PDF tasks, and prefer a version that documents exact PDF operations and asks before side-effecting actions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill advertises write_file and bash capabilities, plus network tools, but provides no user-facing warnings about side effects, remote access, or command execution risks. This creates a transparency and consent problem: users may invoke a seemingly simple PDF helper without realizing it can modify files, execute commands, or contact external resources.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Declaring unrestricted bash for a PDF skill grants broad command execution well beyond the stated purpose, especially when no required binaries or constrained workflow are specified. This can be abused for arbitrary local actions such as filesystem access, script execution, lateral tool use, or staging exfiltration, making the capability set disproportionately dangerous for the advertised function.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill is described only as PDF processing/manipulation, but it exposes generic web_fetch and web_search capabilities without any stated need, constraints, or safety boundaries. Unnecessary network primitives enlarge the attack surface by enabling data exfiltration, retrieval of untrusted remote content, or prompt-driven behavior outside the PDF-specific scope.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrase "Help me with nano pdf" is broad and loosely tied to user intent, increasing the chance of accidental or overly eager invocation. In a skill that also declares bash, write_file, and network tools, unintended activation is more dangerous because it may expose powerful capabilities in situations where the user did not clearly consent to them.

Static analysis

No suspicious patterns detected.