ClawHub
Back to skill

Security audit

Markdown convert

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed ComPDF Cloud PDF-processing skill that requires explicit consent before uploading files and only stores the API key locally if the user opts in.

Install this only if you are comfortable sending the specific PDFs, images, and any required document passwords to ComPDF Cloud for processing. Decline local API-key storage if you do not want the key saved, and avoid uploading highly sensitive or confidential documents unless you have reviewed the provider's privacy and retention terms.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The file presents extensive document-processing capabilities but does not disclose that user files and extracted contents may be transmitted to the external ComPDF Cloud API. In a skill that handles PDFs, OCR, extraction, and conversion, omission of this data-flow warning can cause users or downstream agents to send sensitive documents to a third party without informed consent, creating privacy and compliance risk.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.