Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this PDF processing skill suspicious with medium confidence because scanners report capabilities not disclosed in its description and other review concerns; this does not establish malicious intent.
Consider the suspicious Review verdict before installing. The main concerns are undisclosed PDF capabilities and unclear tool scope; dependency versions are also unresolved. Coverage is incomplete: Skillspector reports 15 of 16 components scanned and one analyzer degraded, so the evidence does not establish that the skill is safe.
The chunk focuses on PDF encryption and access-control management, which the description does not declare. These are distinct document-security capabilities rather than implementation details of the listed operations. No unrelated resource access or password bypass is shown.
The command performs image extraction rather than any of the specifically declared operations. Although it remains within the general domain of PDF processing, image extraction is a distinct, undeclared capability rather than an implementation detail of text or table extraction.
Merging and splitting match the description, and page rotation is ordinary supporting PDF manipulation. However, explicitly removing password protection is an additional security-relevant capability not disclosed in the declared purpose. The command uses a known password; it does not crack passwords or bypass authentication. Declared features absent from this code chunk are not themselves treated as mismatches.
Without declared permissions the skill's intent is opaque and cannot be validated.
The troubleshooting example recommends --replace-input without explaining that it replaces the source document, so an agent could unexpectedly modify a user's original PDF. Qpdf normally preserves an original backup for this operation, reducing the risk of permanent loss, but the instruction still makes an avoidable integrity-changing action the default.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
data["form_fields"][0]["entry_bounding_box"] = [10, 10, 100, 50]
path = self.json_file("invalid.json", data)
script = Path(__file__).with_name("check_bounding_boxes.py")
result = subprocess.run([sys.executable, str(script), str(path)], capture_output=True, text=True)
self.assertEqual(result.returncode, 1)
self.assertIn("intersection", result.stdout)
OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.
OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.
OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
def form(self, field_type="choice", **kwargs):
path = self.root / "form.pdf"
c = canvas.Canvas(str(path))
getattr(c.acroForm, field_type)(name="field", x=30, y=600, **kwargs)
c.showPage()
c.save()
return path