ClawHub
Back to skill

Security audit

Pdf Tool

Security checks for vulnerabilities and agentic risk

Overview

This PDF utility is a straightforward local file tool, with documentation drift and dependency hygiene issues but no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Install only in a normal low-privilege Python environment, preferably with a pinned reviewed pypdf version. Expect basic local PDF text, merge, split, page extraction, and info functions; do not rely on the advertised image extraction, conversion, or compression features unless the package is updated.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/pdf.py:3
Finding

Unpinned Third-Party Dependency Installation Guidance

Content
View full analysis

Vulnerability Details

File Location: scripts/pdf.py:3-5, scripts/pdf.py:15-18, and scripts/pdf.py:34-37
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The script instructs users to install pypdf without specifying a reviewed version, integrity hash, or trusted package index.

python
"""
PDF Tool - Work with PDF files
Note: Requires pypdf (pip install pypdf). Falls back to basic operations.
"""
python
def get_pdf_info(filepath):
    """Get PDF metadata and info."""
    try:
        from pypdf import PdfReader
    except ImportError:
        print("Info: pypdf not installed. Running: pip install pypdf")
        return None
python
def extract_text(filepath, output=None):
    """Extract text from PDF."""
    try:
        from pypdf import PdfReader
    except ImportError:
        print("Error: pypdf not installed. Run: pip install pypdf")
        return 1

Technical Analysis

The command pip install pypdf resolves the package version dynamically at installation time. The project does not provide a version-pinned dependency manifest, lockfile, package hash, or explicit trusted index. Consequently, the installed code may differ from the dependency version originally reviewed.

The script does not execute pip automatically, so exploitation requires the user or an automation layer to follow the displayed installation guidance. If the upstream package, maintainer account, package distribution channel, or a future release were compromised, installation or subsequent import could execute attacker-controlled Python code.

Attack Path

  1. A user invokes a PDF operation in an environment where pypdf is unavailable.
  2. The import raises ImportError.
  3. The script displays guidance to run pip install pypdf.
  4. The user or an automated environment executes that unpinned installation command.
  5. pip retrieves whichever r ...[truncated 1037 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add a dependency manifest that pins a reviewed pypdf version exactly, for example:
    text
    pypdf==REVIEWED_VERSION
  2. Generate and verify cryptographic hashes for all distributions, then install with:
    bash
    python -m pip install --require-hashes -r requirements.txt
  3. Use an organization-approved package index or explicitly document the trusted official index.
  4. Commit a lockfile or equivalent reproducible dependency specification and update it through a controlled review process.
  5. Replace all generic pip install pypdf messages with instructions referencing the pinned, hash-verified dependency file:
    python
    print("Error: dependencies are missing. Run: python -m pip install --require-hashes -r requirements.txt")
  6. Run dependency installation and PDF processing in a minimally privileged virtual environment or container, never as an administrator unless strictly necessary.
  7. Add automated dependency vulnerability and integrity checks to the release process.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill metadata and usage text do not accurately reflect actual behavior and exposed options, including undocumented metadata inspection and advertised but apparently unimplemented features. This mismatch can mislead reviewers and users about what the skill can do, weakening security review and creating room for unsafe invocation patterns or accidental exposure of PDF metadata that users did not expect to inspect or reveal.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The command-line interface declares a --extract-images option, which documents an image-extraction capability to users. However, the option is never handled in main() and there is no corresponding implementation, so the code documentation actively suggests behavior the skill does not perform.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.