Author: tallison
Date: Tue Oct 13 18:42:05 2026
New Revision: 1939095
Log:
update skills links and add trusted host language to security model
Modified:
tika/site/src/site/apt/index.apt.vm
tika/site/src/site/apt/security-model.apt
Modified: tika/site/src/site/apt/index.apt.vm
==============================================================================
--- tika/site/src/site/apt/index.apt.vm Tue Oct 13 18:37:30 2026
(r1939094)
+++ tika/site/src/site/apt/index.apt.vm Tue Oct 13 18:42:05 2026
(r1939095)
@@ -31,10 +31,10 @@ Apache Tika - a content analysis toolkit
lives at {{{./3.3.3/index.html}tika.apache.org/3.3.3}}.
Using Tika from an AI agent? Ready-to-use agent skills --
-
{{{https://github.com/apache/tika/blob/main/.skills/file-to-markdown/SKILL.md}file-to-markdown}}
+
{{{https://github.com/apache/tika/blob/main/.skills/users/file-to-markdown/SKILL.md}file-to-markdown}}
and
-
{{{https://github.com/apache/tika/blob/main/.skills/file-to-markdown-docker/SKILL.md}file-to-markdown-docker}}
- -- live in the {{{https://github.com/apache/tika/tree/main/.skills}.skills
directory}}
+
{{{https://github.com/apache/tika/blob/main/.skills/users/file-to-markdown-docker/SKILL.md}file-to-markdown-docker}}
+ -- live in the
{{{https://github.com/apache/tika/tree/main/.skills/users}.skills/users
directory}}
on GitHub. They are standalone: copy them into any agent's skill directory.
If you're interested in contributing to Tika, please see the
{{{./contribute.html}Contributing}} page
Modified: tika/site/src/site/apt/security-model.apt
==============================================================================
--- tika/site/src/site/apt/security-model.apt Tue Oct 13 18:37:30 2026
(r1939094)
+++ tika/site/src/site/apt/security-model.apt Tue Oct 13 18:42:05 2026
(r1939095)
@@ -21,7 +21,7 @@ Security Model
Tika's risks come in two kinds: untrusted <data>, which applies however
you run Tika, and untrusted <callers>,
which applies only when you expose tika-server or tika-grpc. Both rest on
- {{{Trusted_configuration}trusted <configuration>}}, covered last.
+ {{{Trusted_configuration}trusted <configuration>}} and a
{{{Trusted_host}trusted <host>}}, covered last.
Untrusted data
@@ -87,6 +87,18 @@ Untrusted callers
Securing access is the operator's responsibility, not the project's.
+Trusted host
+
+ Tika assumes the machine it runs on is trusted. An attacker who already
has local access to that machine --
+ who can read or modify the temporary directory, the process's files or
memory, or connect to the
+ communication channel between the tika-pipes client and its forked server
process -- already holds the
+ privileges of the user running Tika. What they can then do to Tika, its
inputs, or its output is not a
+ vulnerability in Tika.
+
+ Protecting the host is the operator's responsibility: run Tika as a
dedicated least-privilege user, restrict
+ permissions on its temporary and working directories, and do not share the
machine with untrusted local users
+ or processes.
+
Trusted configuration
Configuration is trusted input. The <<<tika-config.json>>> and command
line that start the process come from
