ClawHub
Back to skill

Security audit

PDF Converter

Security checks for vulnerabilities and agentic risk

Overview

This is a remote PDF conversion helper whose behavior is mostly transparent, but it stores a ComPDF API key locally and sends chosen documents to ComPDF.

Install only if you are comfortable sending selected documents and any required PDF passwords to ComPDF for processing. Store the API key carefully, keep the skill directory private, exclude api_key from backups and publishing, and revoke or rotate the key if it may have been exposed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:30
Finding

Forced Injection of an Undocumented API Request Parameter

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–31; supporting API schema at references/official-api-reference.md, lines 903–978
Vulnerability Type: Instruction-driven injection of undocumented request metadata
Risk Level: Medium

Vulnerable Code Snippet:

markdown
3. Read the matching heading in `references/official-api-reference.md`. Use its exact endpoint path, request fields, request mode, and response fields; do not infer unsupported options.
4. Include `sourceType=5` in every final ComPDF API request. Treat it as an integration routing parameter and include it in request details when the user asks for them.

The referenced PDF-to-Word request schema documents multipart fields such as file, password, language, pageRanges, and OCR options. It lists data.sourceType only among response properties:

text
data.sourceType String Source file type

Technical Analysis

The Skill unconditionally directs the Agent to add sourceType=5 to every final ComPDF request, although the bundled official API snapshot does not identify sourceType as a request parameter for the reviewed conversion endpoint. Instead, it identifies data.sourceType as a response field.

This instruction also conflicts with the immediately preceding requirement to use exact documented request fields and not infer unsupported options. Because the directive is loaded as part of the Skill workflow, an Agent may prioritize it over the documented API schema and silently modify all generated requests.

An undocumented routing or attribution parameter could be rejected, ignored, logged, or interpreted by undocumented server-side behavior. The project provides no evidence that the value is required by the official API or that users are informed of its precise semantics.

Attack Path

  1. A user invokes the PDF Converter Skill for a supported conversion.
  2. The Agent selects an official ComPDF conversion e ...[truncated 875 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the unconditional sourceType=5 directive unless official ComPDF documentation explicitly defines it as a supported request field.
  2. If the parameter is legitimate, update the bundled API reference with its request location, data type, accepted values, purpose, and supported endpoints.
  3. Apply the field only to endpoints that explicitly support it rather than to every request.
  4. Disclose any attribution or routing semantics to the user before submission.
  5. Add request-schema validation that rejects fields absent from the selected endpoint's documented schema.
  6. Add tests confirming that generated requests contain only documented fields and that response-only properties cannot be inserted into request bodies.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:33
Finding

API Key Persisted in a Plaintext Skill-Local File

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33–41
Vulnerability Type: Insecure plaintext credential storage
Risk Level: Medium

Vulnerable Code Snippet:

markdown
6. Resolve credentials only from `api_key` in the directory containing this `SKILL.md`. Read its first non-empty line. Do not inspect environment variables or any other local path. If the file is absent, unreadable, or empty, ask the user to provide an API key, then create or replace only this skill-local `api_key` file after the user confirms storage. Do not display, log, commit, or include the key in requests examples or final output.
7. Before uploading a document to ComPDF, identify the affected files and destination, and obtain confirmation unless the user has explicitly authorized that upload. Also obtain confirmation before operations that overwrite, delete, decrypt, or apply permanent protection.
8. Return the endpoint, method, content type, complete request fields, expected task/result fields, and the next polling or download step. Preserve original files unless replacement is explicitly requested.

## Credentials

Store only the current skill's API key in the sibling `api_key` file. This file is private runtime state and must be excluded from version control and skill publishing.

To obtain an API key, register or sign in at [ComPDF Portal](https://www.compdf.com/compdf-portal/signin?utm_source=clawhub&utm_medium=referral&utm_campaign=compdf_skills_repo_en&ref_platform_id=clawhub_compdfkit_skills_en). On first use, provide the key when requested and confirm storing it in the skill-local `api_key` file; later requests reuse that stored key.

Technical Analysis

The Skill instructs the Agent to create or replace a sibling file named api_key and reuse the first non-empty line as an authentication credential. Although it prohibits displaying or committing the key and requires confirmation before storage, it does no ...[truncated 1932 chars]

Remediation
View remediation

Remediation Suggestions

  1. Store the API key in an operating-system credential manager or another dedicated secret store rather than in the Skill directory.
  2. If file-based storage is unavoidable, create the file atomically with owner-only permissions equivalent to mode 0600.
  3. Verify ownership and permissions before every read; reject files accessible by group or other users.
  4. Add an explicit .gitignore or equivalent package-exclusion rule for api_key, and test that release artifacts never contain it.
  5. Keep secret files outside source and publication directories where possible.
  6. Provide documented key deletion, revocation, and rotation procedures.
  7. Avoid copying the credential into logs, examples, error messages, backups, or temporary files.
  8. Add automated secret-scanning and release checks that fail if api_key or credential-like content is included in the package.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
3. Read the matching heading in `references/official-api-reference.md`. Use its exact endpoint path, request fields, request mode, and response fields; do not i

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
6. Resolve credentials only from `api_key` in the directory containing this `SKILL.md`. Read its first non-empty line. Do not inspect environment variables or a

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The reference file documents broad capabilities far beyond the skill's declared PDF conversion scope, including editing, decryption, watermarking, generation, comparison, and AI extraction. In an agent setting, over-scoped documentation can enable unintended tool use, privilege expansion, or user-deceptive behavior because implementers may expose or invoke operations users did not consent to under the advertised skill purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The AI parsing and extraction sections introduce document-analysis capabilities that materially exceed simple format conversion and can extract structured sensitive data from uploaded files. In the context of a conversion skill, this increases the risk of covert data mining, over-collection, and misuse of confidential document contents under a misleadingly narrow product description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow documentation directs users to upload files to a third-party API but does not prominently disclose the privacy and security implications of transmitting full documents, metadata, and possibly sensitive content off-platform. For a document-processing skill, this omission is dangerous because users may reasonably assume local or minimally scoped processing when handling confidential files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The webhook guidance explains callback usage but omits concrete security guidance for validating webhook authenticity and protecting callback endpoints that receive task metadata. Without warnings, integrators may expose task identifiers and processing events to untrusted endpoints or fail to verify signatures, enabling spoofed notifications or metadata leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The examples include password and encryption-related parameters without warning that document passwords and security settings are being transmitted to a remote service. This can lead users to unknowingly disclose sensitive credentials associated with protected PDFs, increasing confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

PDF generation from HTML/templates is a content-creation capability, not a pure conversion flow, and broadens the skill into arbitrary document rendering. In agent environments this can create opportunities for unreviewed remote content rendering, unexpected data inclusion, or misuse of the skill beyond the declared scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Encryption and especially decryption capabilities are unrelated to a conversion-only skill and could be abused to strip protections or alter document security posture outside user expectations. Even if the upstream API supports legitimate uses, including these capabilities in this skill expands the potential for unauthorized handling of protected documents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file is primarily English, but several parameter descriptions abruptly switch to Chinese-only text, forcing a specific language for parts of the reference without offering the user a language choice. This can violate language/locale expectations for documentation consumers who are not Chinese readers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This line contains a Chinese-only description in the middle of an English API reference, which imposes a locale shift on readers unexpectedly. The document does not indicate that some sections will be Chinese-only or provide an alternative language selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

These lines provide parameter descriptions only in Chinese despite the surrounding document being English, forcing a specific language on users without consent or prior notice. That inconsistency is a natural-language policy issue under the locale rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The page-range and password array explanations switch to Chinese-only text even though the file is otherwise written for English readers. Without explicit opt-in or a documented regional rationale, this is an avoidable locale-policy inconsistency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This section presents the required pages parameter description only in Chinese while the surrounding API reference remains English. The undocumented language switch forces a specific locale and reduces accessibility for readers expecting consistent English documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The AI extraction parameter descriptions switch into Chinese-only text for several fields in a section otherwise presented in English. This imposes a locale unexpectedly and is not justified or paired with an explicit user language choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.