Pdf Toolkit Free

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:29 AM UTC
• Version: 1.0.0

Overview

This is a Markdown PDF helper with expected file and command use, but users should avoid the weak password example and install dependencies carefully.

Install only if you are comfortable with a Chinese-language Markdown skill that may ask the agent to run Python commands and write PDF outputs. Use a virtual environment, pin or review dependencies, confirm output filenames before writes, and never rely on the sample password for sensitive PDFs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:145

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 145–150
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

# Ensure Python is available
python3 --version
# ...
# Dependencies
pip install requests

Related dependency instructions also appear at lines 233–239:

text

| Dependency | Type | Required | Installation |
| LLM API | API | Required | Provided by the agent's built-in LLM |
| pypdf | Python library | Required | pip install pypdf |
| pdfplumber | Python library | Recommended | pip install pdfplumber |
| reportlab | Python library | Optional | pip install reportlab |

Technical Analysis

The Skill instructs an agent to install packages from the active Python package index without version constraints, integrity hashes, a lock file, or an approved-index restriction. Package selection and transitive dependency resolution are therefore mutable and depend on the environment's pip configuration at execution time.

If a selected package release, transitive dependency, package index, or local pip configuration is compromised, installation or subsequent import can execute attacker-controlled code with the privileges of the agent process. The requests package is not needed by the demonstrated local PDF workflow, so installing it also adds avoidable dependency and network-capable attack surface.

This finding does not establish that any named package is malicious. The risk arises from directing automated execution environments to install mutable, unverified dependencies.

Attack Path

1. A user or agent loads the Skill and follows its environment-preparation instructions.
2. The agent executes an unpinned pip install command.
3. pip queries its configured package index and resolves the latest matching package and transitive dependencies.
4. An attacker compromises a resolved release, dependency, ...[truncated 748 chars]

Remediation

View remediation

Remediation Suggestions

1. Define dependencies in a reviewed lock file or requirements file with exact versions.
2. Require cryptographic hashes, such as through pip install --require-hashes -r requirements.txt.
3. Restrict installation to an approved HTTPS package index and disable unintended extra indexes.
4. Review and pin transitive dependencies, not only top-level packages.
5. Install packages in an isolated virtual environment or sandbox with minimal filesystem and network privileges.
6. Remove requests unless a documented feature genuinely requires it.
7. Prefer prebuilt, centrally vetted environments rather than allowing an agent to install dependencies dynamically.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:166

Finding

Predictable Hard-Coded PDF Encryption Password

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 166–173
Vulnerability Type: Hard-coded weak encryption credential
Risk Level: Medium

Vulnerable Code

python

# Encrypt PDF
writer = PdfWriter()
for page in reader.pages:
    writer.add_page(page)
writer.encrypt("password123")
with open("encrypted.pdf", "wb") as f:
    writer.write(f)
print("PDF encrypted")

Technical Analysis

The PDF-security example encrypts every generated document with the fixed password password123. This value is predictable, publicly visible in the Skill, and likely to be reused when an agent follows the sample without modification.

Encryption does not provide meaningful confidentiality when the decryption credential is known or easily guessed. Because the example does not require a user-supplied password or generate a cryptographically strong random secret, users may incorrectly assume that the resulting PDF is securely protected.

Attack Path

1. A user asks the agent to encrypt a PDF.
2. The agent follows the supplied example without replacing the embedded password.
3. The resulting encrypted.pdf is protected with password123.
4. An attacker obtains the encrypted document through any available channel.
5. The attacker uses the password published in the Skill, or guesses it trivially, and decrypts the document.
6. The attacker reads any confidential content contained in the PDF.

Impact Assessment

Exploitation compromises the confidentiality of PDFs generated with the sample password. The scope is limited to documents encrypted using that known credential; this issue does not independently grant host-system privileges or code execution. Its practical impact may nevertheless be significant if the affected PDFs contain personal, financial, legal, or business-sensitive information.

Remediation

View remediation

Remediation Suggestions

1. Remove the hard-coded default password.
2. Require the user to provide a strong password through a protected input mechanism, or generate one with a cryptographically secure random generator.
3. Enforce an appropriate minimum length and reject common or compromised passwords.
4. Avoid printing, logging, or embedding the password in generated metadata.
5. If a password is generated, deliver it through a separate secure channel from the encrypted PDF.
6. Clear password values from temporary state when the runtime permits.
7. Update the example to fail safely when no password has been provided rather than falling back to a public credential.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises both write and exec capabilities and describes performing file-modifying operations, but it does not clearly warn users that invoking the skill can alter local files or execute system-level actions. In an agent context, this can cause unintended document modification, overwrites, or execution of unsafe commands if user input is passed through operational flows without explicit consent boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example code shows creating an encrypted output file (encrypted.pdf) and modifying document state, but it does not warn that running the example writes a new file and may overwrite or proliferate sensitive content. In a tool-executing agent, examples often become operational guidance, so omission of side-effect warnings increases the risk of accidental data modification or mishandling of confidential PDFs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The natural-language content of the skill, including display name, summary, description, and usage guidance, is presented only in Chinese. Under the language/locale policy, forcing a single language without user opt-in or a documented regional justification is a policy concern.

Content

No source excerpt is available for this finding.