Book PDF to Structured JSON

• Outcome: Pass
• Latest audit: Sep 1, 2026 · 6:53 AM UTC
• Version: 2.0.0

Overview

This is a disclosed local book-conversion skill with proportionate file and command use, but users should not assume its upload and backup workflow is implemented as a turnkey API tool.

Install only if you want an agent to process in-scope book files and write local conversion outputs. For any remote upload, require a separate confirmation of the exact target, a verified backup/export process, and post-upload comparison; do not rely on this skill alone as a complete API upload tool.

SkillSpector

Vulnerability Patterns

• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to read and write local files and execute shell commands, but it does not declare those permissions explicitly. That creates a transparency and policy-enforcement gap: a caller or platform may trust the metadata while the body still drives higher-risk operations, increasing the chance of unintended file access or command execution in a broader-than-expected scope.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The skill promises safe API upload, backup, and full read-back verification, but the described implementation does not actually provide those remote-safety controls. This can mislead operators into believing destructive remote operations are protected by backup and verification when they are not, which raises the risk of unsafe deployment, data loss, or false assurance during content replacement workflows.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill enables implicit invocation while using a broad default prompt that can trigger on generic book-conversion requests without clear boundaries or confirmation. In a high-impact workflow that performs extraction, validation, upload, backup, and verification, this increases the chance of the agent invoking the skill unexpectedly on sensitive documents or taking actions the user did not explicitly request.

Unvalidated Output Injection

High

• Category: Output Handling

Content

str(args.min_heading_score),
            "--fail-on-warnings",
        ]
        validation = subprocess.run(command, text=True, capture_output=True, check=False)
        (work_dir / "validation.log").write_text(validation.stdout + validation.stderr, encoding="utf-8")
        if validation.stdout:
            print(validation.stdout, end="")

• Confidence: 78% confidence
• Finding: The script executes a validator on attacker-controlled content and then prints validation.stdout and validation.stderr directly to the terminal and writes them to logs. If the validator echoes untrusted filenames, document text, or OCR content containing ANSI escape sequences or other terminal control characters, an attacker could perform terminal/log injection, misleading reviewers, hiding errors, or manipulating terminal display in a workflow that processes adversarial book files.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.