Drawing Insight Free

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:25 AM UTC
• Version: 1.0.0

Overview

This skill is a local PDF drawing parser with disclosed file reading, report output, and dependency setup, with no evidence of hidden persistence, exfiltration, or destructive behavior.

Install and run this in a project-specific virtual environment, preferably with a pinned and reviewed pdfplumber version. Only provide drawings you intend the agent to read, and review generated reports before relying on them for engineering decisions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:145

Finding

Unpinned Third-Party Package Installation Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 145, 251, and 305
Vulnerability Type: Unpinned and unverified dependency installation
Risk Level: Medium

Vulnerable Code

The same unsafe installation command appears at lines 145 and 305:

bash

pip install pdfplumber

The dependency table repeats it at line 251:

markdown

| pdfplumber | Python library | Required | `pip install pdfplumber` |

Technical Analysis

The skill permits command execution and directs the agent to install pdfplumber from the active Python package index without specifying an audited version, validating package hashes, using a lockfile, or restricting resolution to an explicitly trusted index.

Consequently, the package and its transitive dependencies are mutable after the skill has been reviewed. The installed artifacts can also be influenced by the environment's pip configuration, including configured index URLs and extra indexes. This creates a supply-chain risk if a package release, transitive dependency, or configured package source is compromised.

The audit found no evidence that pdfplumber itself is malicious. The vulnerability is the unsafe dependency acquisition procedure.

Attack Path

1. An agent loads the skill and receives permission to use its execution tool.
2. The documented setup workflow causes the agent or user to run pip install pdfplumber.
3. Pip resolves the latest compatible package and transitive dependencies using the environment's configured indexes.
4. An attacker compromises a resolved release, a transitive dependency, or a configured package source.
5. Pip installs the attacker-controlled artifact.
6. Malicious package installation or import-time code executes with the privileges of the account running the agent.
7. The resulting access is limited by that account and its execution environment, but may include files, credentials, and network resources available to the process.

Impact Assessment

Successf ...[truncated 602 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin pdfplumber and every transitive dependency to versions that have been reviewed and tested.
2. Generate a lockfile or hashed requirements file and require hash verification during installation.
3. Restrict package resolution to an approved repository rather than inheriting arbitrary pip index configuration.
4. Install dependencies in a dedicated, non-privileged virtual environment or sandbox.
5. Integrate dependency vulnerability scanning and periodically review pinned versions before controlled updates.
6. Document the expected package source and integrity values in the project.

For example:

bash

python -m venv .venv
. .venv/bin/activate
python -m pip install \
  --index-url https://pypi.org/simple \
  --require-hashes \
  -r requirements.txt

A corresponding requirements.txt should contain exact versions and SHA-256 hashes for the complete resolved dependency set. The occurrence at line 305 and the dependency-table instruction at line 251 should be updated consistently.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description emphasizes '单文件快速解析' for one construction PDF, but the usage scenarios describe parsing '各专业图纸' in batch to build a unified index, and elsewhere mention project-wide automated checking. That expands the advertised operational scope beyond the manifest’s single-file positioning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation explicitly states the skill was '完全中文化表达，适配国内建筑工程工作流', which imposes a specific language/locale orientation in the skill’s natural-language behavior. There is no indication that users may choose another language or opt in to this locale-specific mode.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes extracting drawing elements and generating a quality report, but the skill documentation explicitly says some capabilities support '创建/查询/导出操作' and includes writing a Markdown report to disk. File/report output may be reasonable, but the broader create/export wording suggests capabilities beyond the narrowly described parsing scope.

Content

No source excerpt is available for this finding.