ClawHub
Back to skill

Security audit

EPUB ↔ PDF Converter

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward EPUB/PDF conversion skill with disclosed local tooling; users should only redistribute converted documents when they have the right to do so.

Before installing, be comfortable with installing calibre as a system dependency if it is missing, and use the conversion workflow only on documents you are allowed to convert, store, and redistribute. Avoid placing confidential or copyrighted outputs in shared research folders unless access controls and licensing are clear.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly promotes redistribution and archiving of converted PDFs/EPUBs but provides no warning about copyright restrictions, licensing, or handling of sensitive source documents. In an automation context, this can normalize unauthorized copying or retention of proprietary, personal, or research materials and lead to compliance, privacy, or legal exposure.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
brew install calibre

# Ubuntu/Debian
sudo apt-get install -y calibre

# Fedora/RHEL
sudo dnf install calibre
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
sudo apt-get install -y calibre

# Fedora/RHEL
sudo dnf install calibre
```

`calibre` includes `ebook-convert` and supports many formats:
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.