ClawHub
Back to skill

Security audit

ComPDF Convert Images to Documents

Security checks for vulnerabilities and agentic risk

Overview

The skill is scoped to user-approved image-to-document conversion through ComPDF, with some credential and third-party processing risks users should understand.

Install only if you are comfortable sending selected image documents to ComPDF for processing and storing a ComPDF API key in a local plaintext api_key file. Review generated request details, including the fixed sourceType=5 parameter, and use scoped or low-quota API keys where possible.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:37
Finding

Undocumented Routing Parameter Is Unconditionally Added to API Requests

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:37
Vulnerability Type: Request integrity violation and undocumented metadata transmission
Risk Level: Medium

Vulnerable Code Snippet:

markdown
4. Include `sourceType=5` in every final ComPDF API request. Treat it as an integration routing parameter and include it in request details when the user asks for them.

Technical Analysis

The Skill unconditionally requires sourceType=5 to be included in every final ComPDF API request. However, the bundled reference for the supported image-conversion endpoints does not document this numeric value as a request parameter. In those endpoint sections, sourceType is instead presented as a response field describing the source file type.

This instruction conflicts with the Skill's adjacent requirement to use the exact documented endpoint fields and not infer unsupported options. Because the value is described as an integration routing parameter, it may alter server-side routing, attribution, analytics, billing, or processing behavior without a documented API contract.

The value is fixed rather than attacker-controlled, so this finding does not directly enable arbitrary command execution or privilege escalation. The security concern is undisclosed request modification and the transmission of unnecessary metadata alongside uploaded user files.

Attack Path

  1. A user invokes the Skill for an image-conversion task.
  2. The agent selects a documented ComPDF image-conversion endpoint.
  3. The Skill instruction forces the agent to add sourceType=5, even though the selected endpoint documentation does not list it as a request field.
  4. The request, uploaded image, API credential, and undocumented routing value are transmitted to ComPDF.
  5. ComPDF may use the value for routing, attribution, tracking, billing, or other behavior that the user did not explicitly authorize.

Impact Assessment

The issue does n ...[truncated 395 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the unconditional sourceType=5 requirement unless it is part of the official endpoint contract.
  2. If the parameter is required for a legitimate integration, document its exact server-side meaning, accepted location, data type, and privacy implications.
  3. Ensure every generated request contains only fields explicitly supported by the selected endpoint documentation.
  4. Require explicit user disclosure and consent before adding attribution, analytics, affiliate, or routing metadata.
  5. Add schema validation that rejects undocumented fields before a request is sent.
  6. Update the bundled API reference with authoritative documentation for the parameter if ComPDF officially supports it.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:39
Finding

API Key Is Persistently Stored in a Plaintext Skill-Local File

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:39, 43-47
Vulnerability Type: Insecure persistent credential storage
Risk Level: Medium

Vulnerable Code Snippet:

markdown
6. Resolve credentials only from `api_key` in the directory containing this `SKILL.md`. Read its first non-empty line. Do not inspect environment variables or any other local path. If the file is absent, unreadable, or empty, ask the user to provide an API key, then create or replace only this skill-local `api_key` file after the user confirms storage. Do not display, log, commit, or include the key in requests examples or final output.

## Credentials

Store only the current skill's API key in the sibling `api_key` file. This file is private runtime state and must be excluded from version control and skill publishing.

To obtain an API key, register or sign in at [ComPDF Portal](https://www.compdf.com/compdf-portal/signin?utm_source=clawhub&utm_medium=referral&utm_campaign=compdf_skills_repo_en&ref_platform_id=clawhub_compdfkit_skills_en). On first use, provide the key when requested and confirm storing it in the skill-local `api_key` file; later requests reuse that stored key.

Technical Analysis

The Skill instructs the agent to persist the ComPDF API key in a plaintext file named api_key. User confirmation, path restriction, and prohibitions against logging or committing the key are useful safeguards, but they do not protect the credential after it has been written.

The instructions do not require owner-only permissions, ownership validation, symlink rejection, atomic file creation, encryption at rest, or use of an operating-system credential manager. Excluding the file from version control also does not prevent disclosure through permissive filesystem permissions, backups, artifact packaging, diagnostic collection, or another process with access to the Skill directory.

A predictable filename creates an additional ex ...[truncated 1472 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer an operating-system keychain, managed secret store, or runtime credential broker instead of a plaintext file.
  2. If file storage is unavoidable, create the file atomically with owner-only permissions such as 0600.
  3. Verify that the file is a regular file, is owned by the expected runtime user, and is not a symbolic or hard link before reading or replacing it.
  4. Refuse to read a credential file with group or world permissions.
  5. Use a restrictive parent-directory permission model and avoid placing secrets in publishable Skill directories.
  6. Add explicit ignore and packaging-exclusion rules for api_key, and verify those rules during release builds.
  7. Provide credential deletion and rotation procedures.
  8. Limit the API key to the minimum required ComPDF permissions and apply quotas or spending controls where supported.
  9. Never include the key in logs, examples, error messages, command history, telemetry, or generated reports.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
3. Read the matching heading in `references/official-api-reference.md`. Use its exact endpoint path, request fields, request mode, and response fields; do not i

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
6. Resolve credentials only from `api_key` in the directory containing this `SKILL.md`. Read its first non-empty line. Do not inspect environment variables or a

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The manifest says this skill is for converting image files into editable or structured outputs, but this file documents many additional APIs: PDF page editing, PDF generation, encryption/decryption, watermarking, compression, document comparison, and AI extraction/parsing. Those capabilities materially exceed simple image conversion and indicate the skill's documented behavior is much broader than its stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file documents merge, split, delete pages, extract pages, insert pages, and rotate pages APIs. These are document-editing operations, not image-to-document conversion features, and they are not justified by the manifest's narrow conversion-oriented purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

An image-to-document conversion skill does not need capabilities to add or remove PDF password protection. Encryption and decryption are separate document-security operations and are not justified by the manifest's stated use cases of converting screenshots, scans, receipts, forms, and photo-based documents.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The AI overview and related APIs support intelligent document parsing, schema-driven field extraction, grounding, and downstream RAG/review workflows. These are advanced analysis capabilities that go well beyond converting images into output document formats and are not justified by the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation describes uploading files and receiving extracted or converted results from ComPDF, but does not provide an explicit user-facing warning that documents and their contents are transmitted to an external third-party service. In a skill handling screenshots, scans, receipts, and business documents, this omission can lead users to disclose sensitive or regulated data without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The docs include destructive operations such as delete pages and watermark removal without a clear irreversible-action warning. In a document-processing context, users may unintentionally remove content or alter records, causing data loss or integrity issues, especially if they assume the API is a reversible transform like conversion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Generating PDFs from HTML, templates, or input parameters is a content-generation capability, not an image conversion workflow. It is unrelated to the manifest's description of converting existing image files such as scans and screenshots into editable outputs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Adding/removing watermarks, compressing PDFs, and comparing documents are ancillary document-processing features that are not needed to convert images into Word, Excel, PPT, PDF, HTML, RTF, CSV, TXT, or JSON. Their presence broadens the skill into general-purpose PDF tooling without justification from the manifest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

Several parameter descriptions and examples are left in Chinese while the rest of the document is in English, which creates a language accessibility issue for users expecting a single documented language. This is a natural-language policy concern because the file does not offer a language choice or clearly document that parts of the reference are intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This line contains a parameter description entirely in Chinese inside an otherwise English reference, which can prevent some users from understanding important behavior such as image/background retention. Because no opt-in or locale selection is provided, the document inconsistently imposes a specific language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The extraction mode and options documentation in this range is partially or fully Chinese, despite surrounding English content, which makes critical API behavior inaccessible to some readers. This inconsistency effectively forces a locale/language on users without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.