ClawHub
Back to skill

Security audit

PDF Sanitizer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible PII-detection helper, but it is advertised as a PDF redaction tool while the included script only scans text and prints full sensitive matches in JSON.

Review this carefully before installing or using it on real documents. It does not appear malicious, but it is not a complete PDF redactor and may copy full sensitive values into terminal output, logs, transcripts, or saved JSON. Use only on test data unless the implementation is changed to mask matches by default and the documentation accurately describes supported inputs, outputs, and categories.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/detect_pii.py:57
Finding

Unmasked PII Is Disclosed Through Standard Output

Content
View full analysis

Vulnerability Details

File Location: scripts/detect_pii.py:57-63, 67
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: Medium

Vulnerable Code

python
results.append({
    "category": category,
    "description": desc,
    "match": m.group(),
    "start": m.start(),
    "end": m.end(),
    "confidence": 0.95 if category != "ipv4" else 0.6,
})
python
print(json.dumps(results, ensure_ascii=False, indent=2))

Technical Analysis

The detector copies every complete regex match into the match field and serializes the resulting JSON to standard output without masking, truncation, or access controls. This affects detected identity-card numbers, telephone numbers, bank-card numbers, email addresses, passport numbers, and IP addresses.

This behavior also conflicts with SKILL.md:37-39, which describes report output as containing a truncated original snippet:

markdown
7. **Report** — output redacted PDF + JSON report listing each redaction:
   - original snippet (truncated), category, page number, bounding box, mode applied.

Because standard output is commonly captured by shell redirection, CI systems, agent transcripts, application logs, and monitoring infrastructure, otherwise protected PII can be duplicated into less protected storage.

Attack Path

  1. A user or automated workflow extracts text from a document containing sensitive information.
  2. The text is supplied to detect_pii.py through standard input.
  3. A regular expression detects an ID number, bank-card number, phone number, email address, passport number, or IP address.
  4. The complete sensitive value is assigned to the JSON match field.
  5. The script prints the unmasked value to standard output.
  6. A terminal logger, CI runner, agent transcript, monitoring service, redirected file, or downstream process captures and retains the plaintext value.
  7. Anyone with access to that secondary output channel can retrieve the disclosed PII.

...[truncated 617 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the raw match value from default output. Return only the category and positional offsets when possible.
  2. If a preview is required, mask or truncate it according to category, such as preserving only the final four digits:
    python
    def mask_match(value: str) -> str:
    if len(value) <= 4:
        return "*" * len(value)
    return "*" * (len(value) - 4) + value[-4:]
  3. Make disclosure of complete values an explicit opt-in mode with a clear warning rather than the default behavior.
  4. Avoid writing raw sensitive values to application logs, terminal histories, agent transcripts, exception messages, or telemetry.
  5. If reports must be persisted, use restrictive file permissions, encryption at rest, controlled retention, and secure deletion.
  6. Add automated tests verifying that JSON output never contains complete sample ID, payment-card, phone, email, or passport values.
  7. Update the implementation and documentation so the stated truncation guarantee is consistently enforced.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description promises detection and redaction of sensitive information in PDFs, specifically including addresses. The supplied code only processes plain text from standard input and emits JSON describing regex matches; there is no PDF parsing/editing and no redaction step. Additionally, the implemented detectors do not include addresses, while they do include undeclared categories such as email, passport, and IPv4. These are material differences in both primary purpose and capability, so this is a mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The workflow states that the tool outputs a JSON report containing an 'original snippet (truncated)' for each redaction, but the description does not warn users that sensitive source content will be copied into an auxiliary artifact. In a PII-redaction context, that side-channel can defeat the purpose of sanitization by leaking sensitive data through logs, reports, storage, downstream integrations, or human review workflows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest says the skill detects and redacts sensitive information in PDFs, specifically naming ID numbers, phone numbers, addresses, and bank cards. This script also detects email addresses and IPv4 addresses, which expands behavior beyond the described categories; email may be adjacent to PII, but IPv4 especially is not clearly covered by the stated description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.