mm-output

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:15 AM UTC
• Version: 1.0.1

Overview

This is a coherent document-to-poster tool, but its installer and HTML rendering pipeline create security risks that users should review before installing.

Review before installing. Use a sandbox or disposable environment, avoid running install.sh as root, replace curl-to-shell installation with verified packages, remove or pin the Git dependency, update vulnerable dependency pins, and only process documents you trust unless JavaScript is disabled and generated HTML is sanitized before conversion.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:28

Finding

Unverified Remote Installer Is Piped Directly into a Shell

Content

View full analysis

/dev/null; then log_info "Installing UV..." curl -LsSf https://astral.sh/uv/install.sh | sh export PATH="$HOME/.cargo/bin:$PATH" fi log_success "UV version: $(uv --version)" } ``` `SKILL.md:126-129`: ```bash # Install UV curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The installation process downloads a mutable script from an external URL and immediately passes its contents to `sh`. No version is pinned, and no checksum, signature, or other integrity verification is performed before execution. HTTPS provides transport protection but does not make the retrieved payload immutable. If the upstream website, release infrastructure, DNS resolution, certificate trust chain, or delivery account is compromised, the downloaded response can be changed after this Skill has been reviewed. Using Astral's documented UV domain reduces the likelihood that the URL is an intentional impersonation, but it does not eliminate the security weakness inherent in executing an unverified remote response. Installing UV is relevant to the declared functionality, but direct `curl | sh` execution exceeds the minimum safe privilege and integrity model required to install it. The downloaded script executes with all privileges of the user running `install.sh`. If the user invokes the installer as root because the same script later runs `apt-get`, the remote payload may receive full system privileges. ### Attack Path 1. An attacker compromises the upstream installer, hosting account, DNS/TLS infrastructure, or another component in the delivery chain. 2. The attacker replaces the expected UV installer response with a malicious s ...[truncated 935 chars]

Remediation

View remediation

uv-installer.sh" | sha256sum --check - sh uv-installer.sh ``` 4. Prefer a trusted operating-system package or another package distribution mechanism that already performs signature and integrity verification. 5. Separate unprivileged user-level installation from privileged `apt-get` operations. Do not recommend running the complete project installer as root. 6. Update both `install.sh` and `SKILL.md` so the documented installation procedure follows the same verified process. 7. Record the reviewed UV version and expected digest in the repository to make installation reproducible. ]]>

T08 · Insecure Dependencies

Error

• Location: requirements.txt:1

Finding

Mutable and Unpinned Git Dependency Permits Supply-Chain Code Substitution

Content

View full analysis

Remediation

View remediation

``` 5. Verify the pinned commit's provenance and review its build configuration before use. 6. Avoid mutable branch names and tags, since either may be moved after review. 7. Add automated dependency scanning and require review for changes to dependency source URLs, versions, hashes, and lock files. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: renderer_unit.py:107

Finding

Untrusted LLM-Generated HTML Is Executed in a JavaScript-Enabled Browser

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (129)

Known Vulnerable Dependency: torch==2.9.1 — 4 advisory(ies): CVE-2025-3001 (PyTorch is vulnerable to memory corruption through its torch.lstm_cell function); CVE-2025-3000 (PyTorch is vulnerable to memory corruption through its torch.jit.script function); CVE-2026-4538 (A vulnerability was identified in PyTorch 2.10.0. The affected element is an unk) +1 more

Critical

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The project pins PyTorch to a version reported by the scanner as having multiple critical memory-corruption issues. In a skill that parses untrusted documents and uses ML tooling, a vulnerable native library materially increases risk because malformed model inputs or processing paths may trigger crashes or code-execution conditions in the dependency stack.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: transformers==4.57.6 — 9 advisory(ies): CVE-2026-4372 (HuggingFace transformers vulnerable to remote code execution); CVE-2026-1839 (HuggingFace Transformers allows for arbitrary code execution in the `Trainer` cl); CVE-2026-5241 (huggingface/transformers: Arbitrary Code Execution During Model Initialization i) +6 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill depends on a transformers version flagged for multiple arbitrary code execution vulnerabilities. This is especially dangerous here because the skill uses model-related packages in a document-processing pipeline, and model loading/configuration paths are a common attack surface when handling external assets or remote model artifacts.

Content

No source excerpt is available for this finding.

Tainted flow: 'endpoint' from os.getenv (line 380, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The HTTP endpoint is built from environment-controlled base_url and then used for outbound requests carrying the full document and assets. If an attacker can influence environment variables or deployment configuration, they can redirect all rendered content and API credentials to an arbitrary host, turning this into a data-exfiltration and credential-disclosure path.

Content

Scanner excerpt · renderer_unit.py (reported line 397)May include surrounding context.

python

for _ in range(max(1, attempts)):
                try:
                    r = requests.post(endpoint, headers=headers, json=body, timeout=60)
                    if r.status_code < 200 or r.status_code >= 300:
                        raise RuntimeError(f"HTTP {r.status_code}: {r.text[:500]}")
                    data = r.json()

Tainted flow: 'endpoint' from os.getenv (line 380, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · renderer_unit.py (reported line 476)May include surrounding context.

python

last_err: Exception | None = None
        for _ in range(max(1, attempts)):
            try:
                resp = requests.post(endpoint, headers=headers, json=payload, timeout=120)
                if resp.status_code < 200 or resp.status_code >= 300:
                     raise RuntimeError(f"HTTP {resp.status_code}: {resp.text[:800]}")

Known Vulnerable Dependency: torch==2.9.1 — 4 advisory(ies): CVE-2025-3001 (PyTorch is vulnerable to memory corruption through its torch.lstm_cell function); CVE-2025-3000 (PyTorch is vulnerable to memory corruption through its torch.jit.script function); CVE-2026-4538 (A vulnerability was identified in PyTorch 2.10.0. The affected element is an unk) +1 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The analysis indicates torch==2.9.1 is affected by multiple published advisories, including memory-corruption issues. In a skill that ingests complex user-controlled files and may invoke native/ML processing pipelines, such flaws can lead to crashes, denial of service, or potentially code execution depending on reachable code paths.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: cryptography==46.0.5 — 11 advisory(ies): GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); CVE-2026-69247 (cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle th); CVE-2026-69249 (python-cryptography: Duplicate self-signed intermediates can cause exponential p) +8 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence

Finding

cryptography==46.0.5 is pinned despite multiple reported advisories, including critical issues. This skill integrates several remote-service and document-processing libraries, so a vulnerable cryptographic foundation can affect authentication, certificate validation, encrypted content handling, or bundled OpenSSL behavior across the stack. Because many other dependencies rely on cryptography, compromise impact is broad.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: torch==2.9.1 — 4 advisory(ies): CVE-2025-3001 (PyTorch is vulnerable to memory corruption through its torch.lstm_cell function); CVE-2025-3000 (PyTorch is vulnerable to memory corruption through its torch.jit.script function); CVE-2026-4538 (A vulnerability was identified in PyTorch 2.10.0. The affected element is an unk) +1 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence

Finding

torch==2.9.1 is pinned despite multiple critical/high advisories, including memory corruption issues. This project heavily relies on ML/OCR/model execution against user-supplied files and likely loads models, tensors, and media-derived data, making low-level framework vulnerabilities particularly dangerous. In the worst case, these can lead to crashes, denial of service, or code execution in a high-privilege processing environment.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: transformers==4.57.6 — 9 advisory(ies): CVE-2026-4372 (HuggingFace transformers vulnerable to remote code execution); CVE-2026-1839 (HuggingFace Transformers allows for arbitrary code execution in the `Trainer` cl); CVE-2026-5241 (huggingface/transformers: Arbitrary Code Execution During Model Initialization i) +6 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence

Finding

transformers==4.57.6 is reported with multiple arbitrary code execution vulnerabilities, which is highly relevant in a project that depends on OCR and model tooling. Transformer ecosystems often load model configs, tokenizers, processors, and remote artifacts; when those inputs are untrusted, vulnerable versions can permit code execution during initialization or training-related flows. Because this skill’s functionality is deeply tied to model-driven parsing, this is one of the most dangerous findings in the file.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

完整安装（系统依赖 + Python 环境）

bash install.sh

安装完成后，编辑 .env 文件填入 API 密钥

vi .env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

完整安装（系统依赖 + Python 环境）

bash install.sh

安装完成后，编辑 .env 文件填入 API 密钥

vi .env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 95)May include surrounding context.

sh

# 完整安装（系统依赖 + Python 环境）
bash install.sh

# 安装完成后，编辑 .env 文件填入 API 密钥
vi .env
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 98)May include surrounding context.

sh

# 完整安装（系统依赖 + Python 环境）
bash install.sh

# 安装完成后，编辑 .env 文件填入 API 密钥
vi .env
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 114)May include surrounding context.

sh

# 完整安装（系统依赖 + Python 环境）
bash install.sh

# 安装完成后，编辑 .env 文件填入 API 密钥
vi .env
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 139)May include surrounding context.

sh

# 完整安装（系统依赖 + Python 环境）
bash install.sh

# 安装完成后，编辑 .env 文件填入 API 密钥
vi .env
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 146)May include surrounding context.

sh

# 完整安装（系统依赖 + Python 环境）
bash install.sh

# 安装完成后，编辑 .env 文件填入 API 密钥
vi .env
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · paper2slides/image_generator.py (reported line 42)May include surrounding context.

python

# 完整安装（系统依赖 + Python 环境）
bash install.sh

# 安装完成后，编辑 .env 文件填入 API 密钥
vi .env
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · paper2slides/image_generator.py (reported line 53)May include surrounding context.

python

# 完整安装（系统依赖 + Python 环境）
bash install.sh

# 安装完成后，编辑 .env 文件填入 API 密钥
vi .env
```

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill description materially overstates or misstates behavior relative to the referenced implementation, including parsing, rendering, and Gemini image-generation claims. Security reviewers and users may approve or invoke the skill under false assumptions, masking undeclared networked LLM use or other functionality that changes the risk profile.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill description materially overstates or misstates behavior relative to the referenced implementation, including parsing, rendering, and Gemini image-generation claims. Security reviewers and users may approve or invoke the skill under false assumptions, masking undeclared networked LLM use or other functionality that changes the risk profile.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill description materially overstates or misstates behavior relative to the referenced implementation, including parsing, rendering, and Gemini image-generation claims. Security reviewers and users may approve or invoke the skill under false assumptions, masking undeclared networked LLM use or other functionality that changes the risk profile.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description materially overstates or misstates behavior relative to the referenced implementation, including parsing, rendering, and Gemini image-generation claims. Security reviewers and users may approve or invoke the skill under false assumptions, masking undeclared networked LLM use or other functionality that changes the risk profile.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description materially overstates or misstates behavior relative to the referenced implementation, including parsing, rendering, and Gemini image-generation claims. Security reviewers and users may approve or invoke the skill under false assumptions, masking undeclared networked LLM use or other functionality that changes the risk profile.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description materially overstates or misstates behavior relative to the referenced implementation, including parsing, rendering, and Gemini image-generation claims. Security reviewers and users may approve or invoke the skill under false assumptions, masking undeclared networked LLM use or other functionality that changes the risk profile.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description materially overstates or misstates behavior relative to the referenced implementation, including parsing, rendering, and Gemini image-generation claims. Security reviewers and users may approve or invoke the skill under false assumptions, masking undeclared networked LLM use or other functionality that changes the risk profile.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

The skill description materially overstates or misstates behavior relative to the referenced implementation, including parsing, rendering, and Gemini image-generation claims. Security reviewers and users may approve or invoke the skill under false assumptions, masking undeclared networked LLM use or other functionality that changes the risk profile.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.