Clinical Data Extractor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:05 AM UTC
• Version: 1.0.4

Overview

The skill does the clinical-data extraction it advertises, but it uses broad host-browser navigation and a write-capable PDF operation without enough scoping or safeguards.

Install only if you are comfortable with the agent opening supplied clinical-data URLs in the host browser, processing PDFs, and saving reports/images under ~/.openclaw/workspace. Prefer trusted public conference or publisher URLs, avoid internal/private-network links, use read-only PDF extraction, and review or clean the output directory after handling sensitive clinical or business documents.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:106

Finding

Unrestricted URL Navigation May Enable Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:106-113
Vulnerability Type: Unvalidated user-controlled URL navigation
Risk Level: Medium

Vulnerable code:

bash

# Navigate to URL
browser action=open targetUrl=<provided-url>

# Capture page snapshot to extract content
browser action=snapshot format=markdown

Technical Analysis

The workflow directs the host browser to open a user-provided URL without requiring scheme validation, destination filtering, DNS resolution checks, or an allowlist of approved pharmaceutical and conference domains.

Because the browser runs with target=host, its network position may differ from that of the requesting user. If the runtime can reach loopback services, private network hosts, cloud metadata endpoints, or privileged internal web applications, an attacker could provide a URL targeting those resources. The subsequent snapshot operation may return the response content to the agent, creating an SSRF-style read channel.

Browser sandboxing, network isolation, or tool-level URL restrictions could reduce exploitability, but none are required by the skill instructions.

Attack Path

1. An attacker invokes the skill and supplies a URL referencing a loopback address, private address, link-local service, or attacker-controlled redirector.
2. The skill passes that URL directly to browser action=open.
3. The host browser sends the request from the OpenClaw runtime's network context.
4. The skill invokes browser action=snapshot format=markdown.
5. If the destination is reachable and returns readable content, internal information may be incorporated into the generated report or otherwise exposed through the agent.
6. Redirects or DNS rebinding could potentially bypass validation that is performed only on the initial URL.

Impact Assessment

Successful exploitation could permit access to HTTP resources reachable from the host browser but not dir ...[truncated 418 chars]

Remediation

View remediation

Remediation Suggestions

• Permit only https URLs unless another scheme is explicitly required.
• Reject file:, data:, javascript:, ftp:, and other non-web schemes.
• Use an allowlist of approved conference, journal, regulator, and pharmaceutical publication domains.
• Resolve the destination hostname before navigation and reject loopback, link-local, private, multicast, reserved, and unspecified IP ranges for both IPv4 and IPv6.
• Repeat destination validation after every redirect.
• Protect against DNS rebinding by binding validation and connection resolution or by enforcing restrictions at an outbound proxy.
• Run browser automation in an isolated network namespace without access to host-local services, private networks, or cloud metadata endpoints.
• Require explicit user confirmation when a destination is outside the configured allowlist.
• Apply response-size and navigation-time limits to reduce denial-of-service exposure.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:130

Finding

Write-Capable PDF Edit Operation Used for Read-Only Extraction

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:130-133
Vulnerability Type: Excessive file-operation capability and unintended input mutation
Risk Level: Low

Vulnerable code:

bash

# Approach 2: Use nano-pdf with natural language instructions
nano-pdf --file <path-to-pdf> --action edit --instruction "Extract all text content from this PDF, focusing on clinical trial data including drug name, indication, phase, efficacy, and safety results"

Technical Analysis

The stated task is text extraction, but the documented fallback invokes nano-pdf with the write-capable --action edit mode. This violates least-functionality principles because extraction should not require modifying the source document.

Depending on the implementation of nano-pdf, edit mode may overwrite the supplied PDF, generate changes alongside it, or invoke a more privileged processing path than read mode. A malformed or adversarial PDF could therefore exercise code paths and filesystem permissions that are unnecessary for extraction. Even without a parser exploit, accidental modification may damage evidentiary integrity or destroy the original input.

The instruction string is fixed in the audited file, so no command-injection path through that string was identified. The confirmed weakness is the unnecessary use of a mutation-capable operation.

Attack Path

1. An attacker or untrusted user supplies a crafted PDF for clinical-data extraction.
2. The workflow selects the documented natural-language fallback.
3. The agent executes nano-pdf with --action edit against the supplied file.
4. The tool receives permission to process the document through an editing path rather than a read-only path.
5. The original document or related output may be modified if the tool performs in-place or adjacent writes.
6. Any vulnerability specific to the tool's editing pipeline would also become reachable even though editing is not ...[truncated 565 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the --action edit extraction approach entirely.

• Use only a documented read-only operation, such as:

  bash

  nano-pdf --file <path-to-pdf> --action read
  

• If natural-language extraction is required, use a dedicated extraction mode that guarantees the input will not be changed.

• Copy untrusted PDFs into an isolated, non-sensitive working directory and mount the source document read-only.

• Execute PDF processing in a sandbox with no network access and with write access restricted to a dedicated output directory.

• Run the processor as an unprivileged account and apply file-size, page-count, CPU, memory, and execution-time limits.

• Preserve and verify a cryptographic hash of the original PDF before and after extraction.

• Keep the PDF-processing tool patched and document its exact trusted version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly describes fetching data from external URLs/PDFs, using browser automation, and writing generated Markdown to a local path, but it does not warn users about network access, processing of untrusted documents, or filesystem side effects. In an agent skill context, this can lead users to invoke actions that access third-party content or create local files without informed consent, increasing the risk of data exposure, prompt-injection via fetched content, or unintended local writes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description requires markdown output to a filename using Chinese fields, and the configuration further fixes the naming format and output conventions in Chinese. This imposes a specific language/locale behavior without any opt-in or alternative for users who may prefer another language.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

- Alternative: If unavailable, file size reduction or OCR may be needed for scanned PDFs

2. **pdftotext** (poppler-utils)
   - Installation (Debian/Ubuntu): `sudo apt-get install poppler-utils`
   - Installation (macOS): `brew install poppler`
   - Used as fallback if nano-pdf is not available

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill persists extracted content to a fixed path under the user's home directory (~/.openclaw/workspace), creating session-spanning artifacts that may contain sensitive clinical documents, PDF-derived text, screenshots, or URLs. Persistent storage increases the chance of unintended retention, later cross-task exposure, or leakage of proprietary/user-supplied data, especially because the skill also saves images and encourages broad extraction from external sources.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

- Used as fallback if nano-pdf is not available

### Filesystem Requirements
- **Write access to user home directory**: The skill creates markdown files and image files in the configured output path (default: `~/.openclaw/workspace`)

### Configuration Flexibility
All configuration options are defined in the **Configuration** section above and can be modified without reinstalling the skill:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README presents the skill description and user-facing usage content in Chinese, but does not indicate that language is configurable or that other languages are supported. Under the policy for natural-language constraints, forcing a single language without user opt-in can be a locale/language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.