Security audit

中文PDF处理器（免费版）

Security checks across malware telemetry and agentic risk

Overview

This Chinese PDF skill is not clearly malicious, but it needs review because it combines read/write/exec authority with weakly scoped callbacks and generic modify/delete language.

Install only if you are comfortable giving this skill read, write, and command-execution ability for local PDF processing. Keep it limited to trusted PDFs, review any requested output path or callback URL before use, and do not allow it to run unrelated commands or modify/delete non-PDF data.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is advertised as a Chinese PDF processor, but the documentation expands its behavior into generic create/query/modify/delete operations. That scope expansion weakens user expectations and can justify actions outside the stated purpose, increasing the chance of unintended file or data modification when paired with read/write/exec capabilities.

Description-Behavior Mismatch

Low

Confidence: 89% confidence
Finding: The manifest presents a free, single-task personal PDF tool, but the input schema adds a callback URL for asynchronous remote notification. Even if not inherently malicious, this introduces externally directed network behavior that users would not reasonably expect from a local PDF utility.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: A network callback capability is not justified by the skill’s stated purpose of Chinese PDF processing. In a skill that also has exec/write access, hidden or weakly documented outbound requests can enable data exfiltration of document contents, metadata, or processing results to attacker-controlled endpoints.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger examples are broad, ordinary language requests such as parsing reports or extracting tables, without clear activation boundaries. This can cause the skill to activate in situations where the user did not intend to invoke a tool with exec/write capabilities, increasing the risk of unintended actions on local files or documents.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The skill description does not provide clear scope limits or exclusion conditions despite advertising MD+EXEC operation. Ambiguous scope is dangerous here because it can normalize broad interpretation of user requests and lead to overreach beyond safe PDF-processing tasks.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation describes create/query/export-style operations and structured outputs, but does not clearly warn users that the skill may write files or export data. In a document-processing context, silent write/export behavior can overwrite files, create unexpected artifacts, or leak extracted content into unintended locations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill declares exec capability but the description does not clearly warn users that command execution may occur. Hidden command execution is especially risky because a seemingly simple PDF tool can invoke system utilities, package installers, OCR binaries, or shell commands that affect the host environment.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.