ClawHub
Back to skill

Security audit

Ua1 Validator Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it validates user-selected PDFs by sending them to a remote PDF/UA-1 validation API, with no hidden persistence or unrelated behavior found.

Install this only if you are comfortable sending the PDFs you validate to api.ua1.dev or to whatever endpoint you set with UA1_API_BASE. Avoid using it on confidential, regulated, or customer documents unless you have checked the service’s data-handling terms and your organization permits that upload.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill instructs agents to execute a shell script (`bash scripts/validate_pdf.sh ...`) but does not declare corresponding permissions or clearly constrain shell usage. Hidden or undeclared execution capability increases the chance that an agent or reviewer underestimates what the skill can do, which weakens security review and policy enforcement.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill tells agents to upload PDF files to a third-party remote API for validation but provides no warning about privacy, confidentiality, retention, or data-handling implications. This can cause sensitive documents to be exfiltrated outside the local environment without informed operator consent, especially in CI or automated agent workflows.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script uploads the provided PDF to a third-party remote service using curl, but it does not provide any runtime warning, consent prompt, or clear disclosure in the script output before transmitting potentially sensitive document contents. In an agent/CI context, this can silently exfiltrate confidential PDFs, making the behavior materially risky even if the feature is intentional.

External Transmission

Medium
Category
Data Exfiltration
Content
## Endpoints

- Health: `GET https://api.ua1.dev/api/health`
- Validate: `POST https://api.ua1.dev/api/validate`
- Compact mode: `POST https://api.ua1.dev/api/validate?format=compact`
- Metrics: `GET https://api.ua1.dev/api/metrics`
Confidence
97% confidence
Finding
This endpoint is used to POST PDF files to an external API, which constitutes transmission of potentially sensitive document contents to a third party. In an agent context, automated uploads can occur without sufficient user awareness, making confidentiality and compliance risks materially significant.

External Transmission

Medium
Category
Data Exfiltration
Content
- Health: `GET https://api.ua1.dev/api/health`
- Validate: `POST https://api.ua1.dev/api/validate`
- Compact mode: `POST https://api.ua1.dev/api/validate?format=compact`
- Metrics: `GET https://api.ua1.dev/api/metrics`

## Required contract
Confidence
97% confidence
Finding
The compact validation endpoint still sends the full PDF to an external service, so the same confidentiality and data-governance risk applies even if the response format is minimized. Compact output reduces response size, not transmission sensitivity.

External Transmission

Medium
Category
Data Exfiltration
Content
TMP_BODY="$(mktemp)"
TMP_HEADERS="$(mktemp)"

HTTP_CODE="$(curl -sS -D "$TMP_HEADERS" -o "$TMP_BODY" -w '%{http_code}' \
  -X POST "$URL" \
  -F "file=@${FILE_PATH}")"
Confidence
94% confidence
Finding
This code performs external transmission of the input PDF to a network endpoint, which is security-relevant because PDFs may contain regulated, proprietary, or personal data. The skill context increases the danger because it is designed for automation by coding agents and CI systems, where uploads may happen non-interactively and without a human noticing the data leaves the environment.

Static analysis

No suspicious patterns detected.