ClawHub
Back to skill

Security audit

Web To Pdf

Security checks for vulnerabilities and agentic risk

Overview

The skill’s webpage-to-PDF purpose is understandable, but it asks the agent to run broad shell cleanup commands without tight path safeguards.

Install only if you are comfortable with the agent browsing requested URLs, creating and sending PDF files, and cleaning up local PDF outputs. Prefer using it with explicit PDF-export requests and avoid following the shell cleanup examples unless the path is verified to be the exact PDF created in the browser media directory.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared purpose says this skill converts webpages to high-quality PDFs via browser PDF functionality and sends them directly. The actual code does not perform those actions. It merely checks for an input URL and prints progress/completion messages. There are no commands such as a headless browser, wkhtmltopdf, print-to-PDF call, file creation, messaging/send operation, or cleanup. This is a material description-behavior mismatch because the primary advertised functionality is not implemented at all.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
Delete the local PDF file immediately after sending to save space:

```
exec command=rm /path/to/file.pdf
```

Or in one line:
Confidence
95% confidence
Finding
Using `exec command=rm /path/to/file.pdf` is dangerous because it invokes a general-purpose shell command for deletion based on a path that may be variable in real use. If the path is attacker-controlled, incorrectly quoted, or unexpectedly expanded, this can lead to deletion of arbitrary files or other shell-mediated misuse.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
Or in one line:
```
exec command=rm /path/to/file.pdf && echo "✅ PDF cleaned up"
```

## Why This Workflow
Confidence
98% confidence
Finding
The one-line variant `rm /path/to/file.pdf && echo ...` further demonstrates shell chaining, which normalizes use of compound shell expressions in the skill. This increases the likelihood of unsafe command construction and makes exploitation more damaging if any part of the path or command string becomes influenced by untrusted input.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrases are broad enough to match many ordinary requests such as 'show me this page' or 'let me see this website,' increasing the chance of accidental invocation. In context, accidental activation could cause unsolicited browsing, file generation, and later shell-based cleanup steps, which compounds risk compared with a narrowly scoped skill.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill directs immediate deletion of a local file without informing the user or requiring confirmation. Even if the intended target is a temporary PDF, destructive cleanup hidden from the user is risky because mistakes in path handling or implementation could remove artifacts needed for auditability, retry, or user access.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill instructs use of shell execution to delete files and resolve paths even though those actions are not essential to webpage-to-PDF conversion. Introducing `exec` for file operations expands the attack surface: if a file path is malformed, attacker-influenced, or substituted, the command could delete unintended files or execute unexpected shell behavior.

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
Recommending batch scripting for multi-page export broadens the skill from a simple browser-to-PDF workflow into arbitrary script execution. That creates unnecessary capability escalation, making it easier for downstream implementations to introduce command injection, unsafe loops over untrusted URLs, or file-system side effects beyond the skill's stated purpose.

Static analysis

No suspicious patterns detected.