Security audit

pdf-fin-parse

Security checks for vulnerabilities and agentic risk

Overview

This finance PDF parser has a legitimate purpose, but it can send sensitive documents to cloud storage and remote parsing/model services with incomplete scoping and inconsistent disclosure.

Install only if you are comfortable sending PDFs to Volcano LAS and TOS, and possibly to configured VLM providers if using the parse path. Use dedicated low-privilege API keys and a separate TOS bucket, avoid sensitive unpublished documents unless retention is acceptable, review logs for bucket or URL exposure, and manually delete uploaded TOS objects when needed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no explicit permissions while the documented workflow clearly requires environment secrets, local file read/write, and outbound network access to LAS and TOS. This is dangerous because users and orchestration frameworks may invoke it without understanding that sensitive credentials and document contents will be transmitted to external services and written to disk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose presents the skill as a LAS-based PDF parser, but the analysis indicates materially broader behavior including alternate non-LAS parsing paths, use of OpenAI-compatible multimodal models, rule-engine extraction, repair passes, async orchestration, image rendering, and uploads to TOS. This mismatch is dangerous because it obscures actual data flows and execution paths, preventing informed consent and making it harder to assess privacy, egress, and model-supply-chain risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: When --force_vlm is enabled, or when scanned pages are auto-routed to VLM, the parser may send PDF page content to an external model service if API credentials are present. In a finance-document parser, that can expose sensitive filings, drafts, or nonpublic financial data to a third party without a sufficiently explicit user-facing consent or warning at the point of use.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This code renders PDF pages to PNG and sends the full page image to a remote VLM endpoint using an OpenAI-compatible API. In a finance-PDF parsing skill, those pages may contain confidential financials, PII, deal terms, or other regulated data, so external transmission without explicit consent, warning, or policy gating creates a real data-exposure risk even if the feature is intended as a fallback.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The client sends page images and prompts to remote model providers over the network, which can expose sensitive financial document contents to third-party services if operators are unaware of the data flow. In a finance PDF parser, those images may contain non-public financials, personal data, or confidential deal materials, making undisclosed remote transmission materially risky.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: env.sh:8