ClawHub
Back to skill

Security audit

Pdf

Security checks across malware telemetry and agentic risk

Overview

This is a PDF-processing guide with local file and command examples that fit its stated purpose, though users should handle password-protected PDFs carefully.

Safe to install as a PDF-processing guide. Treat PDFs as sensitive local documents: confirm input and output filenames, keep backups before modifying files, only decrypt protected PDFs when authorized, and install optional tools or Python packages from trusted sources.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill includes an explicit example for removing PDF passwords (`qpdf --decrypt`) without any warning, authorization check, or context about only processing documents the user is permitted to access. In an agent skill, this can normalize or facilitate handling protected documents in ways that bypass user-safety expectations around sensitive or access-controlled content.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.