Security audit

PDF精简工具

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a PDF CLI helper, but its instructions broaden into workflow automation, API use, file writing, and command execution without clear boundaries.

Install only if you are comfortable granting this skill command execution and file write authority. Use it on copies of PDFs first, avoid sensitive documents unless you understand whether nano-pdf or any API sends content off-device, and constrain the agent to specific nano-pdf commands rather than the broader workflow and automation language in the skill.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill claims to be a PDF editor, but the usage guide describes a generic DAG/workflow orchestrator with retries, branching, and execution reports. This mismatch can mislead an agent or user about the true operational scope, increasing the chance that the skill will be granted broader execution trust or used in unintended automation contexts.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The skill is presented as a local CLI-based PDF editor, yet it also requires an API key and references an LLM API dependency. This inconsistency obscures the trust boundary: users may assume local-only processing while the skill may actually send document contents or instructions to an external service, creating confidentiality and data-handling risks.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The main features expand the skill from PDF editing into generic file handling, external API integration, and system command execution. That broader capability materially increases risk because an agent may treat the skill as a narrow document tool while it effectively authorizes arbitrary command execution and external communication.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill exposes read/write and PDF editing behavior but does not prominently warn that files may be modified, overwritten, or corrupted. In a document-processing context, unclear mutation semantics can lead to accidental data loss, especially when an agent applies natural-language edits to user files automatically.

Static analysis

No suspicious patterns detected.