ClawHub
Back to skill

Security audit

PDF to Markdown

Security checks across malware telemetry and agentic risk

Overview

The PDF-conversion skill is purpose-aligned, but its installer guidance asks users to run an unpinned remote shell script.

Review and download the installer script before running it, prefer pinned releases or standard package-manager installs in a virtual environment/container, and process only PDFs you are authorized to expose in generated output files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill explicitly encourages parsing arbitrary user-provided PDFs into Markdown, JSON, and HTML, including OCR and metadata-rich JSON output, but it does not warn that sensitive document contents, metadata, coordinates, and extracted structure may be surfaced or persisted in output files. In this context, the omission is security-relevant because users may process confidential PDFs and unintentionally expose their contents to downstream tools, logs, or sharing workflows.

External Script Fetching

Low
Category
Supply Chain
Content
Or use the auto-install script (handles Java + Python automatically):

```bash
curl -fsSL https://raw.githubusercontent.com/opendataloader-project/opendataloader-pdf/main/scripts/install.sh | bash
```

## Usage
Confidence
94% confidence
Finding
curl -fsSL https://raw.githubusercontent.com/opendataloader-project/opendataloader-pdf/main/scripts/install.sh | bash

Chaining Abuse

High
Category
Tool Misuse
Content
Or use the auto-install script (handles Java + Python automatically):

```bash
curl -fsSL https://raw.githubusercontent.com/opendataloader-project/opendataloader-pdf/main/scripts/install.sh | bash
```

## Usage
Confidence
97% confidence
Finding
| bash

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.