Extract PDF Text

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:47 PM UTC
• Version: 1.0.2

Overview

This skill is a local PDF text extraction guide with expected installation and OCR setup steps, with no evidence of hidden data transfer or unrelated behavior.

Install dependencies in a dedicated environment when possible, review package sources before authorizing sudo or system-wide installs, and avoid printing or batch-processing confidential PDFs unless you intend that text and metadata to appear in local outputs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Dependencies Installed from Mutable Package Repositories

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12, SKILL.md:31-34, ocr.md:13-25, and troubleshooting.md:16-21
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:12:

yaml

metadata: {"clawdbot":{"emoji":"📄","requires":{"bins":["python3"],"pip":["pymupdf"]},"os":["linux","darwin","win32"],"install":[{"id":"pymupdf","kind":"pip","package":"PyMuPDF","label":"Install PyMuPDF"}]}}

SKILL.md:31-34:

bash

pip install PyMuPDF

ocr.md:13-25:

bash

brew install tesseract

bash

sudo apt install tesseract-ocr

bash

pip install pytesseract

troubleshooting.md:16-21:

bash

pip install PyMuPDF

Technical Analysis

The Skill directs users or an automated Agent to install PyMuPDF, pytesseract, and Tesseract without specifying reviewed versions, integrity hashes, or a locked dependency set. The Skill metadata similarly declares pymupdf without a version constraint.

These commands resolve packages from mutable external repositories at installation time. Consequently, the code ultimately installed can differ from the code that existed when the Skill was audited. If a package release, package repository, maintainer account, distribution mirror, or dependency in the transitive dependency chain is compromised, installation could introduce malicious code not present in this repository.

The sudo apt install tesseract-ocr instruction also requests a privileged, system-wide package installation. This is not by itself evidence of privilege escalation because the user must authorize sudo, but it increases the potential impact of a compromised repository or package.

No evidence was found that the named packages are currently malicious, that dependency confusion is actively being exploited, or that the Skill intentionally uses an untrusted repository. The risk arises from ...[truncated 1621 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every Python dependency to a specifically reviewed version, for example:

   bash

   python3 -m pip install "PyMuPDF==<reviewed-version>" "pytesseract==<reviewed-version>"
   

2. Maintain a locked requirements file with hashes and install it using hash enforcement:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Update the Skill metadata so its dependency declarations use supported exact-version constraints rather than an unconstrained package name.

4. Document the expected package indexes and operating-system repositories. Avoid adding arbitrary package indexes, mirrors, PPAs, or installation scripts fetched from URLs.

5. Install Python dependencies in a dedicated virtual environment with minimal permissions rather than into a global interpreter environment.

6. Avoid privileged installation where possible. If Tesseract requires a system package, instruct users to verify the configured repository and package signature before explicitly authorizing administrative installation.

7. Establish a controlled dependency-update process that reviews release notes, verifies package provenance, scans the resolved dependency set, and updates pins and hashes only after validation.

8. Consider generating and maintaining an SBOM so that reviewed dependency versions and future changes can be tracked.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · ocr.md (reported line 19)May include surrounding context.

Ubuntu/Debian:

bash

sudo apt install tesseract-ocr

Python binding:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This is a markdown file, so SQP-2 applies to omissions in the skill description. The examples repeatedly extract and print document text and metadata, including batch processing, but the file does not warn that PDFs may contain sensitive or confidential information and that extracted text may be exposed in console output or downstream processing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.