T09 · Insecure Skill Coding Practices
Error
- Location
modules/folder_manager.py:33- Finding
Unvalidated Folder Cache Allows PDF Moves Outside the Configured Output Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill PDF Orgnizer
Security checks for vulnerabilities and agentic risk
Overview
This PDF organizer has a coherent purpose, but it sends document text to external AI providers and moves local files by default with weak safeguards around destination paths and credential storage.
Review carefully before installing. Use dry-run first, do not run it on confidential or regulated PDFs unless sending excerpts to OpenAI or Kimi is acceptable, keep input/output folders private, protect or avoid config.json API-key storage, and inspect .folder_cache.json if reusing an existing output directory.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
setup.py:33- Finding
API Credentials Are Stored in a Plaintext Configuration File
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Known Vulnerable Dependency: PyPDF2==3.0.1 — 2 advisory(ies): CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara); CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara)
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
PyPDF2==3.0.1 is flagged with a known denial-of-service issue (CVE-2023-36464) involving malformed PDF/comment parsing that can trigger an infinite loop. If this skill processes untrusted PDFs, an attacker could cause hangs, excessive CPU consumption, or service disruption, and the minimal context here does not show any compensating controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly states that PDF content is sent to OpenAI for analysis and that files are moved into organized folders, but it does not prominently warn users about privacy, confidentiality, or the fact that reorganization happens by default when dry_run is false. This creates a real security and safety risk because users may unintentionally upload sensitive document contents to a third party and alter their local file layout without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly states it uses OpenAI/Kimi APIs to analyze PDF content, but it does not clearly warn users that document contents will be transmitted to third-party external services. This creates a real privacy and data-governance risk because users may process sensitive, proprietary, or regulated PDFs without informed consent or awareness of external disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description says it uses OpenAI/Kimi API to analyze PDF contents, but it does not prominently warn users that document text may be transmitted to third-party AI services. This creates a real privacy and data-handling risk because users may process confidential, proprietary, or regulated PDFs without informed consent or understanding of external data exposure.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python if api_provider == "kimi": self.client = OpenAI( api_key=api_key, base_url="https://api.moonshot.cn/v1" ) else: # OpenAI self.client = OpenAI(api_key=api_key)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code sends slices of PDF content to third-party LLM APIs for title, author, journal, and topic extraction without any built-in consent, redaction, or user-visible disclosure. If the PDFs contain confidential, regulated, or proprietary data, this can cause unintended data exfiltration and compliance violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code sends extracted PDF text and metadata to an external AI provider via
content_analyzer.analyze_content(...)without any explicit consent flow, privacy notice, or clear warning at runtime. Because PDFs may contain sensitive, proprietary, or personal data, this can cause unintended data disclosure to a third party even when the user may only expect local file organization.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
In normal mode, the program moves user files and renames them without an explicit confirmation prompt immediately before making filesystem changes. This creates a real safety risk: a mistaken configuration, unexpected classification, or incorrect destination mapping can reorganize or effectively hide user documents, causing data loss scenarios or difficult recovery even if not intended maliciously.
- Content
Known Vulnerable Dependency: python-dotenv==1.0.0 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)
Medium
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
python-dotenv==1.0.0 is reported with a symlink-following/arbitrary file overwrite issue in set_key, which can be dangerous if the skill writes to .env files in attacker-influenced paths. The risk depends on whether set_key is actually used, but pinning a version with a known file-write flaw is still a real supply-chain/security weakness in the dependency set.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring at L003 and class docstring at L013 describe the component as analyzing PDF content to extract only title and topic. However, the implementation also extracts author and journal/publication venue data in analyze_content via _extract_author and _extract_journal. This is an active contradiction in the code documentation rather than a mere omission because the stated extraction scope is narrower than the implemented behavior.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring at L1-L4 and class docstring at L14 describe a narrowly scoped file-moving component for organizing PDF files. However, the same class also implements duplicate detection via MD5 hashing (L271-L323) and log export to arbitrary files (L255-L269), which goes beyond the documented intent and makes the documentation materially misleading about the class's responsibilities.
- Content
Static analysis
No suspicious patterns detected.