PDF合并工具（免费版）

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.3

Overview

This PDF merge skill is purpose-aligned and disclosed, with some ordinary setup and file-output cautions but no evidence of deception, persistence, exfiltration, or destructive behavior.

Install dependencies in a virtual environment, prefer only the needed PDF library from a trusted package index, and confirm the exact input PDFs plus a non-existing output filename before running a merge to avoid accidental overwrites.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:133

Finding

Unpinned and Unnecessary Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 133 and 218
Vulnerability Type: Supply-chain exposure through unconstrained package installation
Risk Level: Medium

Vulnerable code snippets:

bash

pip install requests

text

| pypdf | Python library | Required | pip install pypdf |

Technical Analysis

The skill directs the agent to install requests and pypdf without pinning reviewed versions, verifying package hashes, using a lockfile, or requiring an explicitly trusted package index. Package resolution therefore depends on mutable releases and the runtime's configured pip index.

The documented PDF-merging example imports pypdf but does not use requests. Installing requests unnecessarily expands the dependency graph and supply-chain attack surface beyond what the declared local PDF-merging function requires.

This finding does not establish that either named package is malicious. The risk arises from unconstrained installation instructions: a compromised future release, transitive dependency, package-index configuration, or intercepted/untrusted mirror could introduce attacker-controlled code. Python packages can execute code during installation or later when imported.

Attack Path

1. A user or agent follows the environment and dependency instructions in SKILL.md.
2. The agent runs pip install requests and/or pip install pypdf.
3. pip resolves the latest compatible packages and transitive dependencies from its configured index without checking project-provided hashes or a reviewed lockfile.
4. A compromised release, dependency, or configured package source supplies malicious package content.
5. Attacker-controlled code executes during package installation or when the package is imported by the PDF-processing workflow.
6. The code runs with the same operating-system identity, filesystem access, network access, and environment visibility as the invoking agen ...[truncated 629 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove requests because the documented local PDF-merging implementation does not use it.
2. Pin pypdf to a specifically reviewed version rather than resolving an unconstrained latest release.
3. Maintain dependencies in a lockfile and require cryptographic hash verification, such as pip's --require-hashes workflow.
4. Configure an explicitly trusted package index and prevent fallback to unreviewed or unexpected indexes.
5. Install dependencies in an isolated virtual environment or restricted container with minimal filesystem and network permissions.
6. Require explicit user approval before an agent installs or upgrades packages.
7. Add automated dependency auditing and controlled update review so pinned versions can receive verified security updates.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill uses very broad natural-language trigger examples such as '合并这三个PDF文件' and similar generic requests that are likely to overlap with ordinary user instructions. In an agent ecosystem, this increases the chance the skill auto-activates unintentionally and then uses read/exec/write capabilities to perform file operations the user did not explicitly intend through this specific skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation shows merge behavior that writes an output PDF to disk but does not clearly warn that output files are created and may overwrite existing paths. In a skill with write and exec permissions, this omission can lead to accidental data loss, unsafe path selection, or user surprise about filesystem modifications.

Content

No source excerpt is available for this finding.