Security audit

Luke Pdf Read Summarize

Security checks for vulnerabilities and agentic risk

Overview

The PDF summarizer is mostly purpose-aligned, but the package includes a publishing script with a hard-coded ClawHub token and broad upload behavior that needs review before installation.

Install only after reviewing or removing upload.sh, rotating the exposed ClawHub token, and confirming the package contents are limited to the intended skill files. Expect Chinese output and resume-style extraction bias; use it only on PDFs you are comfortable processing with a local PyMuPDF subprocess.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: upload.sh:4
Finding: Hard-Coded ClawHub API Bearer Token
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: pdf-read-summarize.tool.js:22
Finding: Predictable and Non-Exclusive Temporary Python Script Creation
Content: View full analysis
.py`. 2. Before `writeFileSync()` runs, the attacker creates a matching path or a symbolic link to a target writable by the Skill process. 3. The Skill follows the attacker-controlled path when writing the generated Python program. 4. Depending on the prepared target, the write may overwrite an unintended file. 5. Alternatively, if the backing file remains attacker-writable, the attacker modifies it during the interval ...[truncated 911 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: upload.sh:14
Finding: Overbroad Recursive Packaging Can Upload Unintended Local Files
Content: View full analysis
Remediation: View remediation
&2 exit 1 } done zip -- "$ARCHIVE" "${required_files[@]}" unzip -Z1 "$ARCHIVE" curl --fail-with-body --silent --show-error -X POST \ -H "Authorization: Bearer ${CLAWHUB_API_TOKEN}" \ -F "files=@${ARCHIVE};type=application/zip" \ "https://api.clawhub.ai/api/v1/skills/upload" ``` 7. Add a CI publication step that builds from a clean checkout and validates the archive contents against the expected manifest. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example phrase at this line is generic enough to overlap with ordinary requests like analyzing an arbitrary file, not specifically a PDF summary task. In a skill-routing system, this increases the chance of accidental invocation and can interfere with correct tool selection or user expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger conditions are broad enough to activate on common requests about documents, summaries, or PDFs without strong disambiguation. This can cause the skill to be invoked in unintended contexts, leading to incorrect routing, surprising behavior, or the processing of user files when the user did not explicitly request this specific capability.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The header presents the skill as a generic PDF reader/summarizer, but functions such as extractTitle, extractSections, and extractKeyData are tuned to resume-like patterns: age-based title parsing, section keywords like 工作经历/教育经历, and hard-coded organization names. This is not just incomplete documentation; it actively misstates the tool's effective intent and behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code generates the summary entirely in Chinese and uses Chinese-only user-facing status/error messages elsewhere in the file. The policy allows locale constraints only when users are offered a language choice or the restriction is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script recursively zips the entire skill directory and uploads it to an external service without any review, filtering, or warning about what files are included. In the context of agent skills, directories often contain secrets, local config, test artifacts, or unintended files, so this can cause accidental data exfiltration.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 98% confidence
Finding: The script performs authenticated external transmission to a third-party API and embeds a live-looking bearer token directly in the file. This is dangerous because anyone with access to the script can reuse the token, and the upload sends packaged local contents off-host, creating both credential exposure and data exfiltration risk.
Content: Scanner excerpt · upload.sh (reported line 26)May include surrounding context.
sh
-F "version=1.0.0" \ -F "description=PDF 阅读与摘要工具 - 快速读取 PDF 并生成结构化摘要" \ -F "files=@luke-pdf-read-summarize.zip;type=application/zip" \ "https://api.clawhub.ai/api/v1/skills/upload") echo "" echo "📊 上传响应:"

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill is written entirely in Chinese and presents a fixed Chinese output template, while only noting support for Chinese/English PDFs rather than giving users an output-language choice. This can violate language/locale policy if the skill defaults to a specific language without explicit user opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This manifest describes the skill's purpose in broad terms but does not specify when it should activate, what exact user phrases should invoke it, or any exclusion conditions. For a manifest file, the lack of trigger specificity can increase the risk of unintended invocation for general PDF-related requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 61% confidence
Finding: The description and keywords include Chinese-language text and the keyword "中文", which may imply the skill is oriented toward a specific language. Because the manifest does not clarify whether Chinese output is optional, user-selectable, or required for a justified regional purpose, this may conflict with language-choice expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description and keywords explicitly position the skill in Chinese ("PDF 阅读与摘要工具", "中文") with no indication that other languages are supported or that the user can choose a preferred language. This is a natural-language policy concern because it imposes a locale expectation in user-facing metadata without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The header comment at L02 describes the script as only uploading a skill to ClawHub. In practice, the script first changes into the skill directory and recursively archives its contents at L14-L15, which is an additional side effect not reflected by the comment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's user-visible status messages and uploaded description are entirely in Chinese, which imposes a specific language on users. There is no opt-in, language selection, or documented justification that this skill is intended only for a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: pdf-read-summarize.tool.js:90

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: upload.sh:4