Merge Pdf Tool Free

• Outcome: Review
• Latest audit: Jul 23, 2026 · 4:13 PM UTC
• Version: 1.0.0

Overview

This PDF merge skill has a plausible core purpose, but it also includes broad file/exec authority, generic modify/delete language, and unexplained network callback behavior.

Review before installing. Use this only if you are comfortable with a PDF skill that may write local files and invoke Python commands. Avoid providing callback URLs or broad document-management requests unless the publisher narrows the scope and explains the network behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is presented as a narrow PDF merge utility, but the documentation expands scope to generic create/query/export/modify/delete operations. This mismatch can mislead agents or users into granting broader authority than expected, increasing the chance the skill is invoked for unintended actions, especially given declared write and exec capabilities.

Description-Behavior Mismatch

Low

• Confidence: 81% confidence
• Finding: The file describes a basic personal-use PDF tool but also advertises metadata management and async callback handling that are outside the stated core purpose. While not directly exploitable by itself, this kind of scope creep obscures the real behavior of the skill and can mask higher-risk operations from users and policy systems.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Introducing a callback URL into a local PDF merge workflow creates an unnecessary outbound communication path. If honored by an agent or wrapper, this could be abused for data exfiltration, SSRF-style requests, or triggering connections to attacker-controlled endpoints under the guise of normal document processing.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Requiring the requests library and describing network troubleshooting is inconsistent with a local PDF merge tool and suggests unjustified network capability. In a skill that already has exec and file access, unexplained networking increases the attack surface and could enable hidden downloads, uploads, or beaconing behavior.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The invocation patterns are broad and loosely constrained, making it easier for an agent to over-trigger the skill on ambiguous user requests. In the context of a skill with read/write/exec permissions and loosely described behavior, this increases the risk of unintended file operations or execution beyond the user's actual intent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill description does not warn users that it may write files and use exec, despite those being declared tools. For a seemingly simple PDF utility, omission of privileged behaviors undermines informed consent and can cause users or orchestration systems to authorize higher-risk actions than expected.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.