Pdf Tool
Analysis
This is mostly a simple local PDF utility, but its default text-extraction behavior can accidentally overwrite the original file, and it relies on an undeclared unpinned Python dependency.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
output = args.output or args.input.replace('.pdf', '.txt')
return extract_text(args.input, output)
...
with open(output, 'w', encoding='utf-8') as f:
f.write(full_text)The default output path is derived using a case-sensitive string replace. If the input file does not contain lowercase '.pdf' in its name, the output path can be identical to the input path, and the script will open it for writing, potentially overwriting the original PDF.
Note: Requires pypdf (pip install pypdf).
...
print("Error: pypdf not installed. Run: pip install pypdf")The tool depends on an external Python package, but the supplied artifacts include no install spec, requirements file, or pinned version for pypdf.
output_path.mkdir(parents=True, exist_ok=True)
...
for i in range(0, total_pages, pages_per_file):
...
output_file = output_path / f"page_{file_num}.pdf"The split operation creates output directories and writes one file per page chunk without a preflight limit or overwrite check.
convert PDF to images, or compress PDF files ... - Extract images from PDF - Basic compression
The documentation advertises conversion, image extraction, and compression, but the provided script only implements merge, split, text extraction, page extraction, and info display; the --extract-images argument is parsed but not handled.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
output = args.output or args.input.replace('.pdf', '.txt')
...
f.write(full_text)Text extracted from a PDF is saved to a persistent local text file by default, which can duplicate sensitive document contents or later be reused as context.
