ClawHub

URL to PDF

Security checks across malware telemetry and agentic risk

Overview

This skill coherently converts a user-provided web page into a local PDF, with expected browser and network behavior for that purpose.

Install only if you are comfortable with the skill opening URLs from your machine in a Playwright browser and saving the result under Documents or a chosen output path. Avoid using it on localhost, private-network, admin, or credential-bearing pages unless you intentionally want that page rendered into a PDF and shared back through the agent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrases 'Save this url as pdf' and especially 'Convert to pdf for mobile' are broad, natural-language requests that can overlap with ordinary conversation. This increases the chance of unintended activation, causing the agent to fetch attacker-controlled URLs or process content the user did not explicitly intend to hand to this skill.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill loads arbitrary user-supplied URLs in a full browser context without validating the scheme, host, or network destination, and the CLI description does not clearly disclose the security implications. This can be abused for SSRF-style access to internal services or local resources reachable from the host running the skill, and it may also execute untrusted page JavaScript during rendering.

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal