Security audit

TextIn xParse Document Parse (Safer Fork)

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned for document parsing, but it relies on unverified remote installer execution and under-discloses sensitive document and secret-handling risks.

Install only after reviewing the vendor installer or using a verified package source. Do not use this skill on confidential, regulated, or client documents unless you are comfortable sending them to the TextIn/xparse service. Avoid putting real document passwords directly in command lines, and protect any TextIn APP_ID and SECRET_CODE stored in config files, shells, or CI secrets.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:30
Finding: Unverified Remote Installer Downloaded and Executed Directly
Content: View full analysis
Remediation: View remediation
xparse-cli-install.sh" | sha256sum --check - ``` 6. Prefer digital-signature verification using a pinned vendor signing key. 7. Display the downloaded script for inspection and require explicit confirmation after verification. 8. Execute the installer with the least-privileged account necessary and document all files and permissions it will modify. 9. Avoid recommending `xparse-cli update` without version pinning and equivalent integrity checks. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:51
Finding: Protected Document Passwords Exposed in Command-Line Arguments
Content: View full analysis
` | | JSON to stdout | `xparse-cli parse --view json` | | Save markdown | `xparse-cli parse --view markdown --output ` | | Save JSON | `xparse-cli parse --view json --output ` | | Page range | `xparse-cli parse --page-range 1-5` | | Encrypted doc | `xparse-cli parse --password ` | | Character details (bbox, confidence, candidate per char) | `xparse-cli parse --view json --output --include-char-details` | ``` `references/api-reference.md`, lines 13-18: ```markdown ### Document Options | Parameter | Type | Description | |-----------|------|-------------| | `--password` | string | Encryption password for protected PDFs | | `--page-range` | string | Pages to process: `1-5` or `1-2,10-15` (optional, default: all) | ``` `references/cli-guidance.md`, lines 50-58: ```markdown ## Common Scenarios | Scenario | Command | |----------|---------| | Read document content | `xparse-cli parse doc.pdf` | | Inspect parse result as JSON | `xparse-cli parse doc.pdf --view json` | | Specific pages only | `xparse-cli parse doc.pdf --page-range 1-5` | | Encrypted document | `xparse-cli parse doc.pdf --password secret123` | | Save to directory | `xparse-cli parse doc.pdf --output ./result/` | | Save to specific file | `xparse-cli parse doc.pdf --output ./parsed.md` | ``` `references/error-handling.md`, lines 113-120: ```markdown ### Scenario 4: Password-Protected Document ``` User: xparse-cli parse encrypted-document.pdf Error: 40422 (Pass ...[truncated 3107 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation describes use of a document parsing CLI backed by an external API, but it does not warn that user-supplied files and extracted contents are transmitted to a third-party service. In this skill context, that omission is security-relevant because users may provide sensitive PDFs, images, or office documents under the assumption processing is local, causing unintended disclosure of confidential data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The API reference documents a --password flag for protected PDFs without warning that passing secrets on the command line can expose them through shell history, process listings, logs, or agent traces. In this skill, the risk is elevated because the password likely protects sensitive document contents, so both the secret and decrypted document may be exposed during processing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The API Limits section and follow-up note are written in Chinese while the rest of the document is in English, effectively imposing a language switch without user opt-in. This can violate a language/locale policy when users are not given an English equivalent or an explicit locale justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file instructs users to export XPARSE_APP_ID and XPARSE_SECRET_CODE directly in their shell environment, which affects credential privacy and system security posture. The section does not include any warning about shell history, shared terminals, or safer storage practices, so users are not alerted to the sensitivity of these values.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation instructs users to store API credentials either in a config file under the home directory or in shell environment variables, but it does not warn about the security implications of those storage methods. This can lead to inadvertent credential exposure through weak file permissions, shell history, process inspection, logs, or shared CI environments, especially because the skill is explicitly aimed at automation and production use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.