ClawHub
Back to skill

Security audit

PDF Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed ComPDF cloud PDF-processing integration that asks for user confirmation before uploading files and does not show hidden execution or persistence beyond optional API key storage.

Install this only if you are comfortable sending selected documents to ComPDF's cloud service. Review each upload confirmation carefully, avoid using it for highly sensitive files unless your policy allows that service, and store the API key locally only if you accept plaintext local credential storage.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill advertises very broad trigger phrases such as 'process this pdf', 'handle pdf file', and 'multiple pdf operations', which can overlap with many ordinary PDF-related requests. This raises the risk of unintended invocation of a skill that uploads user documents to an external service, potentially causing privacy-impacting routing mistakes even when later consent steps exist.

External Transmission

Medium
Category
Data Exfiltration
Content
| Code | Description | Troubleshooting |
|---|---|---|
| 06001 | File processing quota exhausted | Purchase quota or wait for quota reset; visit https://api.compdf.com/api/pricing-old/?utm_source=clawhub&utm_medium=skillhub&utm_campaign=compdf_pdf_skill_pdf_toolkit&ref_platform_id=clawhub_skills for more credits |

### 07xxx - Feature Errors
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
| Code | Description | Troubleshooting |
|---|---|---|
| 06001 | File processing quota exhausted | Purchase quota or wait for quota reset; visit https://api.compdf.com/api/pricing-old/?utm_source=clawhub&utm_medium=skillhub&utm_campaign=compdf_pdf_skill_pdf_toolkit&ref_platform_id=clawhub_skills for more credits |

### 07xxx - Feature Errors
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This markdown file documents a `pdf/delete` operation that removes pages from a PDF, but it provides only usage syntax and examples with no warning that the action deletes content and may be irreversible if the original file is not preserved. For markdown files, destructive behaviors that could affect user data should include an explicit warning.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest describes a PDF toolkit for page organization, basic editing, viewing, and general PDF document processing. This reference file enumerates broader capabilities such as intelligent document extraction/parsing, OCR/table extraction, and many non-PDF conversions involving images, Word, Excel, PowerPoint, HTML, CSV, JSON, and Markdown, which materially exceed a PDF-focused toolkit description.

Scope Creep

Low
Category
Excessive Agency
Content
"Contribution" shall mean any work of authorship, including
   the original Work and any and all modifications thereof or Derivative
   Works thereof, and any and all modifications thereof. If the Work is
   a software module, then a Contribution includes, but is not limited
   to, any source code, object code, patch, and documentation related
   to the Work; and, for purposes of this definition, Contribution means
   any work of authorship submitted to, or already incorporated in, the
Confidence
70% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.