PDF to Word Review

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:18 AM UTC
• Version: 0.1.0

Overview

The skill does the advertised PDF-to-Word review, but it recommends installing the converter from an unpinned live GitHub source, so the code a user runs can change after review.

Install only if you are comfortable running external Python code from the referenced project. Prefer a pinned, reviewed PyPI version or immutable Git commit, use a virtual environment or sandbox, avoid administrator/root execution, and be cautious with confidential PDFs because the converter will process their contents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:27

Finding

Unpinned Third-Party Package Installation from Mutable Remote Sources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:27-33; duplicated in README.md:16-19
Vulnerability Type: Unpinned dependency installation from PyPI and a mutable Git repository
Risk Level: High

Vulnerable Code

SKILL.md:27-33:

bash

# Option 1: PyPI (after official release)
pip install pdf2word-review

# Option 2: GitHub direct install (works today, recommended)
pip install git+https://github.com/xiyanjun/pdf-to-word-review.git

README.md:16-19:

bash

pip install git+https://github.com/xiyanjun/pdf-to-word-review.git
pdf2word input.pdf -o output.docx --verify --html

Technical Analysis

The Skill directs the Agent to install and execute an external package without pinning an audited package version, immutable Git commit, or artifact hash. In particular, the Git installation command resolves the repository's mutable default branch at installation time. Consequently, the code installed by this workflow can change after the Skill itself has been audited.

Python package installation may execute attacker-controlled build backend logic, setup hooks, dependency installation behavior, and package initialization code. The subsequent pdf2word invocation also directly executes the installed package while processing user-controlled or potentially sensitive PDF documents.

This project contains only documentation and does not vendor the conversion engine. Therefore, the effective implementation and its transitive dependencies cannot be verified from the audited project contents. This is a supply-chain weakness rather than proof that the currently referenced upstream project is malicious.

Attack Path

1. An attacker compromises the upstream GitHub repository, its maintainer account, the PyPI project, or an unpinned transitive dependency.
2. The attacker adds malicious package build logic or runtime code to the version resolved by the unpinned installation command.
3. An Agent f ...[truncated 1289 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace unversioned PyPI installation with an exact, reviewed version:

   bash

   python -m pip install "pdf2word-review==<audited-version>"
   

2. If Git installation is unavoidable, pin an immutable, reviewed full commit hash rather than the mutable default branch:

   bash

   python -m pip install \
     "pdf2word-review @ git+https://github.com/xiyanjun/pdf-to-word-review.git@<full-reviewed-commit-hash>"
   

3. Prefer a locked requirements file containing hashes for the package and all transitive dependencies, and install it with hash verification:

   bash

   python -m pip install --require-hashes -r requirements.lock
   

4. Remove wording that recommends direct installation from a mutable Git branch. Document the exact upstream revision that was reviewed and establish a controlled process for reviewing and updating that revision.

5. Install and execute the converter in an isolated virtual environment or sandbox with minimum filesystem and network access. Do not run installation or conversion as an administrator or root user.

6. Restrict the converter to only the required input and output directories. Disable outbound network access during document processing unless it is explicitly required.

7. Verify package provenance where available, review release signatures or attestations, and continuously scan pinned direct and transitive dependencies for compromise and known vulnerabilities.

SkillSpector

Vulnerability Patterns

• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match
• Confidence: 89% confidence

Finding

The README instructs users to install and execute code directly from a GitHub repository using pip install git+https://..., which bypasses the stronger supply-chain assurances of pinned, reviewed releases. If the upstream repository, dependency chain, or referenced branch changes maliciously, users of the skill could install attacker-controlled code during setup.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

• reconciliation, and interprets the result for the user.

• Engine repo: https://github.com/xiyanjun/pdf-to-word-review
• PyPI: https://pypi.org/project/pdf2word-review/

Why this skill

Most PDF→Word tools only convert. This one converts and verifies — it reconciles four dimensions and flags silent content loss, split/merged tables, and dropped images.

Quick start

bash

pip install git+https://github.com/xiyanjun/pdf-to-word-review.git
pdf2word input.pdf -o output.docx --verify --html

Requirements

• Core: pdf2docx, PyMuPDF, python-docx, lxml (auto-installed)
• Optional OCR (scanned PDFs only): macOS Vision (pyobjc-framework-Vision pyobjc-framework-Quartz) or PaddleOCR (paddleocr paddlepaddle)
• Layout polish is macOS-only; use --no-polish elsewhere

License

Engine: AGPL-3.0. This skill vendors no engine code.

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match
• Confidence: 95% confidence

Finding

The skill recommends installing and executing code directly from a GitHub repository via pip install git+https://..., which pulls remote code at install time without version pinning, integrity verification, or provenance controls. If the repository, dependency chain, or transport context is compromised, users may execute attacker-controlled code on their systems during installation.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

s not vendor any engine code.

Installation

Check whether the CLI is available first:

bash

pdf2word --help >/dev/null 2>&1 && echo "installed" || echo "need install"

If missing, install (GitHub direct install works even before the PyPI release):

bash

# Option 1: PyPI (after official release)
pip install pdf2word-review

# Option 2: GitHub direct install (works today, recommended)
pip install git+https://github.com/xiyanjun/pdf-to-word-review.git

Only four lightweight core dependencies are pulled in automatically (pdf2docx, PyMuPDF, python-docx, lxml). OCR is optional — see "Scanned PDF OCR".

Workflow

Step 1: Confirm the input

• Verify the user's path exists and is a .pdf.
• Batch mode: multiple PDFs are supported in one pass.

Step 2: Convert (auto-routed)

bash

pdf2word <input.pdf> -o <output.docx> --verify --html

The CLI detects the text layer and routes automatically:

Case	Automatic behavior
Has text layer	convert

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file describes file-writing behavior via -o <output.docx>, --html, and --report <json>, which affects user data and filesystem state. While the behavior is implied by the command flags, there is no explicit user-facing warning about created artifacts or the need to choose safe paths before running the conversion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.