temp_pdf_skill11

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:11 AM UTC
• Version: 1.0.0

Overview

This is a straightforward PDF-processing guide with purpose-aligned examples and no hidden execution or persistence behavior.

Install only the PDF/OCR libraries you actually need, preferably with pinned versions in a virtual environment, and use password/decryption examples only on documents you are authorized to modify.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:324

Finding

Unpinned Third-Party Dependencies in OCR Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:324
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Complete Code Snippet:

python

# Requires: pip install pytesseract pdf2image

Technical Analysis

The OCR instructions direct the agent or user to install pytesseract and pdf2image without specifying reviewed versions, cryptographic hashes, a lockfile, or a trusted package index. Consequently, package resolution is mutable and depends on the configured Python package source at installation time.

If an upstream package, transitive dependency, or configured package index is compromised, attacker-controlled code could run during package installation or when the dependency is imported. This is a supply-chain weakness rather than evidence that the named packages are currently malicious.

Attack Path

1. A user asks the agent to extract text from a scanned PDF.
2. The agent follows the prerequisite at SKILL.md:324.
3. pip resolves the latest available package versions from its configured index.
4. An attacker compromises a resolved package, transitive dependency, release account, or package source.
5. Malicious package code executes during installation or subsequent import.
6. The code operates with the privileges and filesystem or network access of the process running the installation or OCR task.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the invoking user or agent runtime. Depending on that environment's permissions, the affected scope could include accessible project files, user-owned files, environment variables, credentials available to the process, and reachable network resources. The instruction itself does not request elevated privileges, persistence, or unauthorized access, so the maximum practical impact depends on the runtime's existing permissions.

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed exact version.
• Resolve and pin all transitive dependencies in a lockfile.
• Require cryptographic hashes by using a hashed requirements file with pip install --require-hashes.
• Configure an explicitly trusted package index or an internally controlled artifact repository.
• Perform dependency vulnerability and provenance checks before approving updates.
• Install dependencies in an isolated, least-privilege virtual environment or container.
• Avoid granting the installation process administrative permissions or unnecessary access to credentials and sensitive files.
• Replace the inline installation comment with a reproducible command, for example:

  bash

  python -m pip install --require-hashes -r requirements-ocr.txt
  

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The comment on L215 includes Chinese text '保持原画质', introducing a specific language choice inside the skill content without any indication that the user requested Chinese or that the skill is region-specific. This can violate language/locale policy because the file does not offer a language choice or document a justified locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.