ClawHub
Back to skill

Security audit

Pub Pdf

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it exposes a broad remote API gateway with email, SMS, media, search, and document-upload capabilities under a PDF-oriented name.

Review carefully before installing. Use this only if you intend to give the agent a SkillBoss API key and allow remote processing across many model/tool categories, not just PDFs. Avoid using it with confidential documents, recordings, contact lists, email/SMS workflows, or OTP flows unless you have separate confirmation and data-handling controls.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:2
Finding

PDF Skill Grants Excessive Capabilities and Enables External Disclosure of Sensitive Data

Content
View full analysis
Hi"} }' ``` ```bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "prelude/verify-send", "inputs": {"target": {"type": "phone_number", "value": "+1234567890"}} }' ``` ### Technical Analysis The Skill is presented under the generic and narrowly suggestive name `pdf`, but it requests both `Read` and `Bash` access and documents functionality far beyond PDF p ...[truncated 2300 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:74
Finding

Unvalidated API-Controlled URL Is Downloaded with Redirect Following

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
audio-models.md:29
Finding

Documentation Invokes an Unbundled Executable Without Version or Provenance Controls

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (43)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill is marketed as a PDF manipulation toolkit, but its contents expose a broad general-purpose API gateway for chat, media generation, search, scraping, email, SMS, and other networked capabilities. This mismatch increases the chance that users or higher-level agents will invoke powerful external actions they did not reasonably expect from a PDF-scoped skill, creating covert capability expansion and data-flow risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Email sending and SMS verification are high-risk outbound communication capabilities unrelated to a PDF-focused skill. In this context, they enable unexpected exfiltration, unsolicited messaging, or abuse of OTP workflows under the cover of a benign-looking document tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documented model set materially exceeds the stated PDF-focused purpose by including outbound messaging, embeddings, and presentation-generation capabilities. This creates a scope-mismatch risk: an agent or user may invoke powerful unrelated tools that can exfiltrate data, contact external recipients, or perform actions far outside expected PDF processing, violating least privilege and user expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

OTP verification and bulk SMS capabilities are especially dangerous in a PDF skill because they enable external communications and account-verification workflows unrelated to document handling. In this context, these tools could be misused for spam, social engineering, unauthorized notifications, or transmission of sensitive document-derived data to phone numbers without clear user awareness.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
76% confidence
Finding

The documented base URL establishes that the skill depends on an external API platform for operation. External dependence is not inherently unsafe, but here it is significant because the service aggregates many unrelated capabilities behind one key, increasing the impact of misuse or misunderstanding.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

This models-list request sends authenticated traffic to the external API. Although lower risk than content-upload endpoints, it still confirms remote connectivity and credential use that should be transparent to users of a narrowly described skill.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

List Models

bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

This models-list request sends authenticated traffic to the external API. Although lower risk than content-upload endpoints, it still confirms remote connectivity and credential use that should be transparent to users of a narrowly described skill.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

List Models

bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
77% confidence
Finding

Filtering models by type still involves authenticated communication with the external service. In isolation this is routine, but within a deceptively scoped skill it contributes to a broader-than-advertised remote capability surface.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Filter by type:

bash
curl -s "https://api.heybossai.com/v1/models?types=image" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
77% confidence
Finding

Fetching model documentation from the external service is another authenticated outbound call. This reinforces that the skill is a general API client rather than a focused local PDF utility, which is the core security concern here.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Get full docs for specific models:

bash
curl -s "https://api.heybossai.com/v1/models?ids=mm/img,bedrock/claude-4-5-sonnet" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The chat completions endpoint transmits prompts and conversation content externally for processing. That can expose sensitive text, and its presence is unexpected in a skill nominally dedicated to PDF operations.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Chat

bash
curl -s -X POST https://api.heybossai.com/v1/chat/completions \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Image, video, speech, and music generation capabilities are outside the stated PDF scope and indicate unjustified capability bloat. While not inherently malicious, bundling these functions under a PDF skill undermines least privilege and increases the chance of misuse or accidental data exposure to external services.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This endpoint uploads image-generation requests to an external platform. The security issue is amplified by misleading skill framing, which obscures that user-provided prompts and generated asset flows are leaving the environment.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Image Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This endpoint uploads image-generation requests to an external platform. The security issue is amplified by misleading skill framing, which obscures that user-provided prompts and generated asset flows are leaving the environment.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Image Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

This workflow not only requests remote generation but also downloads a returned URL, introducing an additional external content retrieval step. That expands both outbound and inbound remote interaction beyond what a PDF utility should silently encompass.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Save to file:

bash
URL=$(curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The remote video-generation call sends prompts to an external provider. This is an unnecessary capability for a PDF skill and broadens the opportunity for unexpected data transfer and misuse.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Video Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The remote video-generation call sends prompts to an external provider. This is an unnecessary capability for a PDF skill and broadens the opportunity for unexpected data transfer and misuse.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Video Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

Image-to-video accepts an external image URL and prompt for remote processing, creating both data-sharing and remote-resource handling risks. Its presence is materially out of context for a PDF tool.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Image-to-video:

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This TTS example sends text to a third-party service where it may be stored or logged. Because users would not infer audio synthesis from a PDF-branded skill, the external transmission risk is insufficiently contextualized.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Text-to-Speech

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This TTS example sends text to a third-party service where it may be stored or logged. Because users would not infer audio synthesis from a PDF-branded skill, the external transmission risk is insufficiently contextualized.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Text-to-Speech

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The STT request uploads audio content and metadata externally, which can include sensitive or identifying information. That is a notable privacy exposure compounded by the mismatch between declared and actual skill function.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Speech-to-Text

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The STT request uploads audio content and metadata externally, which can include sensitive or identifying information. That is a notable privacy exposure compounded by the mismatch between declared and actual skill function.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Speech-to-Text

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

Music-generation requests transmit prompts to a remote service for non-document processing. This is not inherently malicious, but it is unrelated capability expansion that weakens least-privilege boundaries.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Music Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The background-removal endpoint processes externally hosted or user-supplied image data via a remote provider. In this context, it is another unexpected data egress path unrelated to PDF work.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Background Removal

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The background-removal endpoint processes externally hosted or user-supplied image data via a remote provider. In this context, it is another unexpected data egress path unrelated to PDF work.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Background Removal

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

Document processing itself may be relevant to the advertised purpose, but this example still sends documents by URL to an external service without emphasizing the data-transfer implications. Sensitive PDFs or DOCX files could be uploaded or fetched remotely without sufficient warning.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

Document Processing

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{