Security audit

Smart Image to PDF

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently converts user-selected images into a printable PDF, with only ordinary dependency and trigger-word caution needed.

Installers should understand that the skill will run a local Python script over image files they provide and may download Pillow and numpy through uv if they are not already available. Use it on intended image-to-PDF tasks, review the output path before running, and prefer pinned dependencies or a trusted package environment for stronger supply-chain control.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:32
Finding: Unpinned Runtime Dependency Resolution
Content: View full analysis
/scripts/combine.py -o ``` `scripts/combine.py:17-19`: ```python except ImportError: print("Missing dependencies. Install with: pip install Pillow numpy") sys.exit(1) ``` ### Technical Analysis The documented execution command asks `uv` to resolve the latest compatible releases of `Pillow` and `numpy` at runtime. The fallback message similarly recommends installing both packages through `pip` without specifying exact versions, package hashes, a trusted index, or a reviewed lockfile. Consequently, the dependency code executed by the Skill is not fully determined by the audited repository. It may change between invocations as package releases and resolver results change. An attacker who compromises an upstream package release, configured package index, package mirror, or local package-manager configuration could cause a malicious dependency to be retrieved. After resolution, the script directly imports the dependencies: ```python from PIL import Image import numpy as np ``` Attacker-controlled code embedded in either imported package can therefore execute in the Python process under the invoking user's identity. ### Attack Path 1. An attacker compromises a relevant package release or gains influence over the package index, mirror, or resolver configuration used by `uv` or `pip`. 2. The attacker supplies a malicious version or artifact under a dependency name requested by the Skill. 3. A user follows the documented `uv run --with Pillow --with numpy` command or the fallback `pip install Pillow numpy` recommendation. 4. The package manager resolves and downloads the attacker-controlled artifact because no exact ve ...[truncated 901 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list includes generic phrases such as "拼接", "打印", and "combine images", which can occur in ordinary conversation and may refer to tasks other than generating a paginated PDF. The file does not provide exclusion conditions or negative examples to narrow when the skill should activate.
Content: No source excerpt is available for this finding.