T08 · Insecure Dependencies
Warning
- Location
SKILL.md:141- Finding
Unpinned and Unnecessary Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
中文PDF处理器（免费版）
Security checks for vulnerabilities and agentic risk
Overview
This Chinese PDF skill appears purpose-related, but it asks for command and file-write authority while giving broad modify/delete and dependency-install instructions without clear limits.
Review before installing. Use this only in a constrained workspace, install dependencies in a virtual environment, prefer pinned package versions, and require explicit confirmation before it runs shell commands, installs packages, sends callback notifications, or writes/modifies/deletes files.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises read, exec, and write capabilities but does not provide a prominent warning or operating constraints for file-system and command execution effects. In practice, this can normalize dangerous behavior and lead users or the agent to run shell commands, modify files, or install dependencies without understanding the security impact.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill name, summary, description, and examples are all framed exclusively around Chinese-language PDF processing, and the input description refers to Chinese-oriented handling without offering any user language or locale choice. That can constitute a language/locale policy issue unless the locale limitation is explicitly justified and documented as an intentional region- or language-specific tool.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The capability descriptions are extremely broad and repeatedly state support for generic create/query/export and even modify/delete style operations via input parameters and runtime config, without constraining when the skill should activate or what resources it may touch. In a skill that declares both exec and write tools, this increases the chance of over-triggering and unintended file or system-affecting actions from ordinary user requests.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example invocations such as parsing a report, running OCR on a document, or extracting tables are phrased in a very generic way and overlap with common user requests that could appear in unrelated contexts. Because the skill also has exec and write access, overly generic triggers can cause the agent to invoke this skill unexpectedly and process local files or generate outputs without sufficiently clear user intent.
- Content