Security audit

pdf

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent PDF-processing skill with local helper scripts, but users should handle sensitive documents and destructive repair examples carefully.

Install only if you are comfortable letting the agent process PDFs you provide and create local intermediate PNG, JSON, and PDF files. Use a private working directory for sensitive documents, delete intermediate files when finished, only decrypt PDFs you are authorized to access, and avoid in-place repair commands unless you have a backup.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The supplied code chunk does not implement a comprehensive PDF manipulation toolkit. It is a test module for a helper function (get_bounding_box_messages) that checks form-field bounding boxes for intersections and sizing issues. While this could be tangentially related to PDF form handling, the code shown neither manipulates PDFs nor performs the broad capabilities claimed in the description, such as text/table extraction, PDF creation, merging, splitting, or form filling. Its primary purpose is materially narrower and different from the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code chunk has a narrower and materially different function than the declared description. It renders PDF pages into PNG images using pdf2image and saves them to disk, with optional resizing. While this is broadly related to 'processing' PDFs, the declared description emphasizes text/table extraction, PDF creation, merging/splitting, and form handling, and does not mention converting PDFs to images. Because the actual code performs a distinct PDF-to-image export capability not explicitly declared, this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation provides a direct example for removing PDF passwords using qpdf without any warning to verify authorization or handle sensitive documents appropriately. In a document-processing skill, this can normalize bypassing protections on confidential files and may lead users or agents to decrypt restricted documents without policy checks, increasing the risk of unauthorized disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs generating and storing field metadata, extracted images, JSON mappings, and a filled PDF, all of which may contain sensitive personal or document data. Without any warning about data minimization, secure storage, cleanup, or user confirmation, the workflow can cause inadvertent persistence and exposure of PII in intermediate artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The non-fillable-form workflow expands the exposure further by creating full-page PNGs, validation images, bounding-box metadata, and an annotated output PDF, potentially duplicating sensitive contents across multiple files. Because the instructions mandate these artifacts and omit any warning or safeguards, users may unknowingly leave highly sensitive document data in plaintext-adjacent image/JSON outputs or shared workspaces.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example uses qpdf --replace-input corrupted.pdf, which overwrites the original file in place after attempting repair. In a skill meant to guide automated PDF processing, presenting a destructive command without an explicit warning or safer alternative can cause irreversible data loss if an agent or user applies it to the only copy of a document.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.