ClawHub
Back to skill

Security audit

Erdmannsilva Nano Pdf

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small, purpose-aligned PDF-editing wrapper, with the main caution that it installs an unpinned third-party PyPI package.

Before installing, consider that nano-pdf will be fetched from PyPI at install time without a fixed reviewed version. Use it in a constrained workspace, avoid exposing sensitive files or credentials unnecessarily, and review output PDFs before sharing them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party dependency from PyPI
Risk Level: Medium

json
metadata: {"clawdbot":{"emoji":"📄","requires":{"bins":["nano-pdf"]},"install":[{"id":"uv","kind":"uv","package":"nano-pdf","bins":["nano-pdf"],"label":"Install nano-pdf (uv)"}]}}

Technical Analysis

The installation metadata directs uv to install nano-pdf from PyPI without specifying an exact version or verifying an artifact hash. Consequently, the code installed on a future invocation is not fixed to the version reviewed when this skill was published.

If the package owner account or distribution infrastructure is compromised, or a future package release becomes malicious, installation can introduce attacker-controlled code. The repository contains no embedded scripts or evidence that the currently referenced package is malicious; the finding concerns the mutable and unverified dependency boundary.

Attack Path

  1. An attacker compromises the upstream nano-pdf publishing account or otherwise causes a malicious release to be served under that package name.
  2. The attacker publishes a newer package version containing malicious installation or runtime behavior.
  3. A user installs the skill dependency through the declared uv installer.
  4. Because no version or artifact hash is constrained, the installer resolves the attacker-controlled release.
  5. Malicious code can execute during package installation, command startup, or subsequent nano-pdf edit use with the privileges of the process running the agent.

Impact Assessment

Successful exploitation could execute arbitrary code under the agent or installer account. The resulting scope may include access to files readable or writable by that account, modification of processed PDF documents, theft of environment-provided credentials, and network access available to the process. This declaration does n ...[truncated 126 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin nano-pdf to an explicitly reviewed version, for example by changing the package specification to an exact version supported by the installer.
  • Use a lockfile or equivalent mechanism containing cryptographic hashes for the package and all transitive dependencies.
  • Obtain packages only from the intended authenticated package index; do not permit unexpected fallback indexes.
  • Review the pinned release and its dependency graph before publishing updates.
  • Perform dependency installation and PDF processing in a sandbox with minimal filesystem access, no unnecessary credentials, restricted network access, and no administrative privileges.
  • Introduce an explicit update process that reviews and tests each dependency version before changing the pin.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.