Nano PDF V2

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:32 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward wrapper for a PDF editing CLI, with the main caveat that it installs an unpinned third-party package.

Before installing, consider whether you trust the nano-pdf package source and prefer using a pinned, reviewed version in a sandboxed environment. Always review generated PDFs before sharing them, since the skill itself tells the agent to rely on an external PDF-editing tool.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

yaml

metadata: {"clawdbot":{"emoji":"📄","requires":{"bins":["nano-pdf"]},"install":[{"id":"uv","kind":"uv","package":"nano-pdf","bins":["nano-pdf"],"label":"Install nano-pdf (uv)"}]}}

Technical Analysis

The installation configuration retrieves the third-party nano-pdf package from PyPI through uv without specifying an exact version or an expected artifact hash. Consequently, the installed package may change independently of this skill's reviewed contents.

The dependency's implementation is not included in the audited project, which contains only SKILL.md and _meta.json. Its installation-time and runtime behavior therefore cannot be verified from the available source. If the upstream account, package, release process, or package repository were compromised, a malicious release could be selected during a subsequent installation.

Attack Path

1. An attacker compromises the upstream package publisher, release pipeline, or package-distribution channel.
2. The attacker publishes a malicious version of nano-pdf.
3. A user installs this skill's requirement through the unpinned uv package declaration.
4. Dependency resolution selects the attacker-controlled release.
5. Malicious package installation or runtime logic executes under the privileges of the user or agent invoking the package.

This attack path depends on an upstream supply-chain compromise; no direct evidence of malicious behavior in the current nano-pdf package was present in the audited files.

Impact Assessment

A compromised dependency could execute code with the permissions of the installing or invoking account. Depending on those permissions, potential effects include reading or modifying accessible files, altering PDF inputs or outputs, accessing environment-provided cr ...[truncated 206 chars]

Remediation

View remediation

Remediation Suggestions

• Pin nano-pdf to a specific, reviewed version instead of allowing unconstrained resolution.
• Use a lockfile or installation mechanism that verifies cryptographic hashes for the expected distribution artifacts.
• Verify the package publisher, source repository, release provenance, and signatures where available.
• Review the pinned dependency and its transitive dependencies before deployment.
• Perform installation and execution in a sandbox or minimally privileged environment with restricted filesystem, credential, and network access.
• Establish a controlled dependency-update process that requires security review before changing the pinned version or hashes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.