ClawHub
Back to skill

Security audit

EPUB ↔ PDF Converter

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward EPUB/PDF conversion skill with disclosed local tooling; users should only redistribute converted documents when they have the right to do so.

Before installing, be comfortable with installing calibre as a system dependency if it is missing, and use the conversion workflow only on documents you are allowed to convert, store, and redistribute. Avoid placing confidential or copyrighted outputs in shared research folders unless access controls and licensing are clear.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly promotes redistribution and archiving of converted PDFs/EPUBs but provides no warning about copyright restrictions, licensing, or handling of sensitive source documents. In an automation context, this can normalize unauthorized copying or retention of proprietary, personal, or research materials and lead to compliance, privacy, or legal exposure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
brew install calibre

# Ubuntu/Debian
sudo apt-get install -y calibre

# Fedora/RHEL
sudo dnf install calibre

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

sudo apt-get install -y calibre

Fedora/RHEL

sudo dnf install calibre

text

`calibre` includes `ebook-convert` and supports many formats: