ClawHub
Back to skill

Security audit

Pdf Label Made In China

Security checks for vulnerabilities and agentic risk

Overview

The skill’s PDF-labeling purpose is understandable, but it tells the agent to repeatedly install an unpinned package with sudo, which is more system authority than the task needs.

Review before installing. The core PDF-label workflow is plausible, but the skill should remove `sudo pip3 install`, use an isolated pinned dependency, and include or clearly scope the referenced processing script. Do not run it in an environment where the agent has passwordless sudo unless the dependency path has been controlled and reviewed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:35
Finding

Privileged Global Package Installation Violates Least Privilege

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:35
Finding

Unpinned Runtime Dependency Installation Creates a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
99% confidence
Finding

The explicit use of sudo invokes root privileges for package installation, which is unnecessary for the stated PDF-label editing task and materially increases operational risk. In this context, a document-processing skill should not require privileged execution because compromise of the package install path would grant elevated access to the host.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

单类型标签（所有页面条形码相同）：

bash
sudo pip3 install PyPDF2 -q
python3.11 /home/ubuntu/skills/pdf-label-made-in-china/scripts/add_made_in_china.py \
  <input.pdf> <output.pdf> \
  --barcode <条形码> \

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs operators to run sudo pip3 install PyPDF2 -q, which performs a privileged, system-wide package installation unrelated to the minimum necessary action of editing a PDF. Using sudo pip can alter shared Python environments, introduce unreviewed code with root privileges, and create persistence or system instability if the package source or dependency chain is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Telling the operator to install a Python package via sudo pip3 install without warning about elevated privileges encourages unsafe execution practices. Even if PyPDF2 itself is commonly used, this pattern normalizes root-level environment modification and increases the blast radius of dependency confusion, malicious packages, or accidental breakage.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
99% confidence
Finding

Repeating the instruction to 'always' run sudo pip3 install PyPDF2 -q reinforces a dangerous operational pattern and increases the chance that operators will perform unnecessary root-level changes on the host. The repetition makes the unsafe behavior part of the standard workflow rather than an exceptional setup step.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
## 注意事项

- 始终先用 `sudo pip3 install PyPDF2 -q` 确保依赖已安装
- 输出文件命名建议：`原文件名_modified.pdf`
- 多类型PDF：脚本自动通过条形码识别每页类型，无需手动分页
- 字体默认 Helvetica 8号，FBA标签可用 11号（`--font-size 11`）

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The description states that users upload label PDFs and that the modified file will later be sent back, which implies handling user data. The markdown does not include any notice about reviewing file contents, privacy considerations, or safe handling of uploaded documents.

Content

No source excerpt is available for this finding.