pdf-analyze

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The guide embeds plaintext passwords directly in an example CLI command and in code (e.g., --password=mypassword and writer.encrypt("userpassword","ownerpassword")), which instructs including secret values verbatim and is therefore insecure.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text can be embedded in an input PDF (including AcroForm field values/annotations) and is ingested at runtime via pypdf when extracting form field metadata/rects and annotations (e.g., reader.get_fields(), page.get('/Annots', []), and FreeText(text=...)), with no requirement to pre-select a specific trusted item.