Security audit

PDF工具包（专业版）

Security checks for vulnerabilities and agentic risk

Overview

This PDF skill is not clearly malicious, but it asks for file-writing and command-execution authority while using broad activation and overclaiming capabilities that are not actually implemented in the artifact.

Install only if you are comfortable with an agent using this skill to read and write local PDF files and run commands for PDF tooling. Treat the advertised pro, API, security, OCR, and conversion claims as unverified, keep outputs in a controlled directory, avoid sensitive PDFs unless audit logs are protected, and do not provide API keys unless a specific trusted integration is actually present.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill advertises PDF conversion and broader integration capabilities that are not actually implemented in the provided code, creating a documentation-to-implementation mismatch. This can mislead an agent or user into assuming unsupported operations, increasing the chance of unsafe fallback behavior, incorrect tool invocation, or over-trust in unverified functionality.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The document contradicts itself by first stating that no extra API key is required and later instructing users to configure API keys for some features. This inconsistency can cause insecure operator behavior, such as unnecessary secret provisioning, storing credentials in the wrong place, or enabling integrations that were not clearly disclosed up front.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The skill claims enterprise-grade security and auditing, but the implementation writes a plaintext JSON audit report containing operation details. In a document-processing context, audit records can expose sensitive filenames, workflow details, and possibly derived metadata, so overstating security controls is dangerous and may lead users to handle sensitive PDFs under false assumptions.

Vague Triggers

High

Confidence: 96% confidence
Finding: The activation condition is extremely broad and can match many generic productivity or automation requests unrelated to PDF handling. Because the skill declares read, write, and exec capabilities, overly broad triggering raises the chance that it will be selected inappropriately and perform file-modifying or command-executing actions outside the user's specific intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill exposes file modification and command execution capabilities without an upfront, prominent warning about data loss, overwrites, or system impact. In this context, that omission is risky because users may treat the skill as passive documentation while it is actually positioned to alter files and invoke commands, increasing the chance of unintended destructive actions.

Static analysis

No suspicious patterns detected.