My Pdf Extract Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:04 AM UTC
• Version: 1.0.0

Overview

This is a straightforward PDF-to-Excel extraction skill with ordinary dependency and output-file caveats, not evidence of malicious behavior.

Install this only in a dedicated virtual environment, avoid running pip as an administrator, consider pinning dependency versions, and choose an output filename that will not overwrite an important spreadsheet. The package appears incomplete because it references a script and reference image that are not included.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51

Finding

Unpinned Third-Party Python Dependencies in Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51-54
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

bash

## 安装依赖
```bash
pip install pdfplumber pandas openpyxl

text

### Technical Analysis

The installation instructions direct users to install several packages from the default Python Package Index without exact version constraints, package hashes, a lockfile, or an explicit trusted index. Consequently, dependency resolution is mutable: the versions and transitive dependencies installed can change after the skill has been reviewed.

Python package installation may execute package build hooks or other installation-time code. If a named package, one of its transitive dependencies, or the configured package repository is compromised, malicious code could execute during installation. The absence of hashes also prevents pip from verifying that downloaded artifacts match artifacts reviewed by the project maintainers.

The package names shown are established packages rather than apparent typosquatting attempts. Therefore, this is a supply-chain hardening deficiency, not evidence that the documented packages are currently malicious.

### Attack Path

1. An attacker compromises a listed dependency, a transitive dependency, or a package source used by the victim's pip configuration.
2. The attacker publishes a malicious release or artifact that remains compatible with the unconstrained package requirement.
3. A user follows the documented `pip install` command.
4. Pip resolves and downloads the attacker-controlled version or artifact.
5. Malicious installation or runtime code executes under the account running pip.
6. The malicious dependency can access resources available to that account and may later execute when the PDF extraction workflow imports it.

### Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges
...[truncated 537 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the direct unconstrained installation command with a reviewed dependency file containing exact versions.

• Generate and distribute hashes for every direct and transitive dependency.

• Require hash verification during installation, for example:

  bash

  python -m pip install --require-hashes -r requirements.txt
  

• Use a lockfile generated by a dependency-management tool and review dependency changes before updating it.

• Document the expected trusted package index and avoid untrusted or implicitly configured extra indexes.

• Install dependencies in a dedicated, non-privileged virtual environment.

• Add automated dependency vulnerability and integrity scanning to the release process.

• Periodically update pinned versions through a controlled review and testing workflow rather than permitting automatic unconstrained resolution.

T08 · Insecure Dependencies

Warning

• Location: README.md:14

Finding

Unpinned Third-Party Python Dependencies in README Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 14-17
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

bash

### 1. 安装依赖
```bash
pip install pdfplumber pandas openpyxl

text

### Technical Analysis

The README instructs users to resolve and install mutable package versions from pip without a lockfile, exact version pins, cryptographic hashes, or a specified trusted repository. A security review of the current dependencies therefore cannot guarantee that users will later receive the same code.

Package installation can invoke Python packaging build mechanisms, and installed packages execute when imported by the application. A compromised direct or transitive dependency could thus introduce attacker-controlled code at installation time or when the extraction workflow runs.

No evidence establishes that the named packages are currently malicious. The confirmed issue is the lack of controls needed to make dependency installation reproducible and resistant to supply-chain compromise.

### Attack Path

1. An attacker gains control of an applicable package release, transitive dependency, distribution artifact, or package source.
2. The attacker makes a malicious version eligible for unconstrained dependency resolution.
3. A user copies and runs the command from the README.
4. Pip selects and installs the malicious artifact because no version or hash policy excludes it.
5. Attacker-controlled code executes during installation or when the package is imported.
6. The code operates with the permissions and resource access of the affected user or extraction process.

### Impact Assessment

Exploitation could result in arbitrary code execution under the installing user's privileges. Potentially exposed resources include local documents, processed PDF contents, generated Excel files, environment variables, user-level credentials, and reachable services.

The docu
...[truncated 210 chars]

Remediation

View remediation

Remediation Suggestions

• Make the README reference a reviewed, version-pinned requirements or lock file instead of listing unconstrained package names.

• Pin all direct and transitive dependencies and include cryptographic artifact hashes.

• Enforce installation integrity with:

  bash

  python -m pip install --require-hashes -r requirements.txt
  

• Specify the approved package index and warn against untrusted extra indexes.

• Direct users to create and activate an isolated virtual environment before installation.

• Avoid administrative installation and document the minimum permissions required.

• Scan dependency updates for known vulnerabilities and review changes before refreshing pins and hashes.

• Keep the README and SKILL.md installation procedures synchronized so users consistently follow the hardened process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill documentation is written only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language content of the skill file is fully in Chinese, and there is no indication that users may opt into another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific context. Under the stated policy, forcing a specific language without user opt-in is a language/locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown skill description states that extracted data will be output to an Excel file, which is a file-writing operation affecting user data. While the document explains inputs and outputs, it does not include a user-facing warning about creating or overwriting the output file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.