T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/md2pdf-local.sh:69- Finding
Execution of an Unverified Script from a Hard-Coded External Path
- Content
View full analysis
- Remediation
View remediation
Security audit
Markdown to PDF Converter (v2.0)
Security checks for vulnerabilities and agentic risk
Overview
This PDF converter is mostly purpose-aligned, but it needs review because first-run setup downloads unverified assets and runs a developer-specific external script path.
Review this skill before installing. It is intended to convert Markdown to PDF, but first run reaches GitHub, extracts an unverified archive, and executes a Python helper from a hard-coded developer path. Prefer a version that runs the bundled helper by relative path and verifies the Twemoji archive checksum before extraction.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scripts/md2pdf-local.sh:17- Finding
Twemoji Archive Is Downloaded and Extracted Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (16)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 1. Check if emoji cache exists: `ls ~/.cache/md2pdf/emojis/` 2. Check if mapping exists: `ls ~/.cache/md2pdf/emoji_mapping.json` 3. If missing, delete cache and re-run: `rm -rf ~/.cache/md2pdf` 4. Verify emoji file exists: `ls ~/.cache/md2pdf/emojis/1f600.png` ### Emoji Displaying as Black-and-White
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 1. Check if emoji cache exists: `ls ~/.cache/md2pdf/emojis/` 2. Check if mapping exists: `ls ~/.cache/md2pdf/emoji_mapping.json` 3. If missing, delete cache and re-run: `rm -rf ~/.cache/md2pdf` 4. Verify emoji file exists: `ls ~/.cache/md2pdf/emojis/1f600.png` ### Emoji Displaying as Black-and-White
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 1. Check if emoji cache exists: `ls ~/.cache/md2pdf/emojis/` 2. Check if mapping exists: `ls ~/.cache/md2pdf/emoji_mapping.json` 3. If missing, delete cache and re-run: `rm -rf ~/.cache/md2pdf` 4. Verify emoji file exists: `ls ~/.cache/md2pdf/emojis/1f600.png` ### Emoji Displaying as Black-and-White
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 1. Check if emoji cache exists: `ls ~/.cache/md2pdf/emojis/` 2. Check if mapping exists: `ls ~/.cache/md2pdf/emoji_mapping.json` 3. If missing, delete cache and re-run: `rm -rf ~/.cache/md2pdf` 4. Verify emoji file exists: `ls ~/.cache/md2pdf/emojis/1f600.png` ### Emoji Displaying as Black-and-White
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 1. Check if emoji cache exists: `ls ~/.cache/md2pdf/emojis/` 2. Check if mapping exists: `ls ~/.cache/md2pdf/emoji_mapping.json` 3. If missing, delete cache and re-run: `rm -rf ~/.cache/md2pdf` 4. Verify emoji file exists: `ls ~/.cache/md2pdf/emojis/1f600.png` ### Emoji Displaying as Black-and-White
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is described as an offline Markdown-to-PDF converter, but it fetches Twemoji from GitHub at runtime if the cache is missing. This creates an unexpected network dependency, expands the trust boundary to external infrastructure, and can expose users to supply-chain or availability risks despite the offline marketing.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh mv "$CACHE_DIR/twemoji-${TWEMOJI_VERSION}/assets/72x72" "$EMOJI_DIR" # 清理 rm -rf "$CACHE_DIR/twemoji-${TWEMOJI_VERSION}" "$CACHE_DIR/twemoji.tar.gz" echo " Twemoji 已缓存至: $EMOJI_DIR"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documentation clearly instructs use of shell commands, file reads/writes, and persistent cache creation, but the manifest declares no explicit tool scope or permissions. This creates an authorization ambiguity where an agent may invoke broader capabilities than a reviewer expects, increasing the chance of unsafe execution in environments that rely on declared scopes for policy enforcement.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md --- name: md2pdf-converter description: Offline Markdown to PDF converter with FULL Unicode support using Pandoc + WeasyPrint + local Twemoji cache (3660 colorful emojis). Converts Markdown documents to professional PDFs with Chinese fonts and colorful emojis (complete version with all variants). Use when user needs to convert Markdown reports or documents to PDF, generate PDFs with emoji support, create PDFs with proper Chinese character rendering, or work offline after initial setup. --- # Markdown to PDF Converter (Complete Version)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install fonts-arphic-uming # Check if installed fc-list | grep "AR PL UMing"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Ubuntu/Debian sudo apt-get install fonts-arphic-uming # Check if installed fc-list | grep "AR PL UMing"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code file contains user-facing natural-language text in a single forced locale, starting with the module description in Chinese. The script also prints Chinese status and error messages later, and nowhere offers a language option or documents a justified locale restriction, which fits the language/locale policy violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Natural-language strings in comments and console output are written only in Chinese, which effectively forces a specific language for users interacting with the script. The policy allows locale constraints only when documented and justified or when users are offered a choice.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
A document-conversion utility generally does not need network access during normal operation, yet this script performs a remote download from GitHub. Even if intended for initial setup, that capability increases attack surface and may violate user expectations in restricted or sensitive environments.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script downloads external content with only routine progress output and no meaningful warning that network access will occur. This is dangerous because users may run it in environments where outbound connections are sensitive, logged, or prohibited, and they are not given informed choice before the request is made.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This script executes a subprocess command to run generate_emoji_mapping.py from a fixed filesystem location. While subprocess execution is part of the implementation, the user-facing description and usage line do not disclose that an additional script will be executed during setup.
- Content
Static analysis
No suspicious patterns detected.