ClawHub
Back to skill

Security audit

Nutrient Document Processing (Universal Agent Skill)

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent document-processing skill, but users should treat uploaded documents and the unpinned MCP package setup with care.

Install only if you are comfortable sending selected documents, form data, redaction targets, and signing inputs to Nutrient's cloud API. Use a narrow SANDBOX_PATH, avoid highly sensitive or regulated files unless third-party processing is approved, and prefer pinning or preinstalling a reviewed MCP server version instead of relying on unpinned npx at runtime.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:58
Finding

Unpinned npm Package Downloaded and Executed at Runtime

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58–59 and 87
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

json
"command": "npx",
"args": ["-y", "@nutrient-sdk/dws-mcp-server"],
text
- MCP server mode (`npx @nutrient-sdk/dws-mcp-server`) downloads the official Nutrient MCP server package from npm at runtime.

Technical Analysis

The recommended MCP configuration invokes npx -y without specifying an exact package version or verifying package integrity. Each installation can therefore download and execute whichever package release currently resolves under the @nutrient-sdk/dws-mcp-server name.

The artifact does not contain a lockfile, integrity hash, vendored implementation, or exact version constraint that would make dependency resolution reproducible. Although the package is described as official, a compromised npm publisher account, malicious upstream release, or other supply-chain incident could change the code executed after this skill has been reviewed.

The -y option automatically accepts the installation, reducing the opportunity for users to inspect the resolved version before execution.

Attack Path

  1. An attacker compromises the upstream npm publisher account, package distribution process, or a future package release.
  2. The attacker publishes a malicious version under @nutrient-sdk/dws-mcp-server.
  3. A user starts the MCP server using the documented npx -y configuration.
  4. npm resolves and downloads the mutable package version without an exact version or integrity pin.
  5. The malicious package executes locally with the privileges of the user running the MCP client.
  6. The package may access inherited environment variables, including NUTRIENT_DWS_API_KEY, and files available through the configured sandbox or process permissions.

Impact Assessment

Successful exploitation could result in arbitrary c ...[truncated 668 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact reviewed version, such as:
    json
    "args": ["-y", "@nutrient-sdk/dws-mcp-server@X.Y.Z"]
  2. Use a lockfile and npm integrity metadata where the MCP client deployment model permits it.
  3. Prefer installing the dependency through a controlled build process rather than downloading it whenever the MCP server starts.
  4. Verify package provenance, signatures, and integrity before installation.
  5. Upgrade only through a documented review process that examines dependency changes before deployment.
  6. Avoid automatic installation acceptance where practical, or validate the resolved package version before execution.
  7. Configure SANDBOX_PATH to the narrowest directory required for the current task.
  8. Provide the MCP process only the required API key and avoid exposing unrelated credentials through inherited environment variables.
  9. Run the MCP server under a dedicated, least-privileged operating-system account or isolated container.
  10. Monitor npm advisories and upstream repository releases for package compromise or unexpected ownership changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (23)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation keywords are extremely broad (PDF, document, extract, sign, merge, etc.), so the skill may trigger in many ordinary conversations that are not intended to invoke a networked document-processing workflow. In an agent setting, overbroad triggering increases the chance of unintended external document transmission or invocation of risky operations on sensitive files.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This section explicitly states that requests go to https://api.nutrient.io/build, meaning documents and extracted content are transmitted to an external service. In a document-processing skill, that is expected functionality, but it is still a real data-exfiltration boundary that can expose sensitive files, OCR text, key-value extractions, and PII to a third party if invoked without informed consent.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

export NUTRIENT_API_KEY="your_api_key_here"

text

All requests go to `https://api.nutrient.io/build` as multipart POST with an `instructions` JSON field.


## Safety Boundaries

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to execute an MCP server via npx @nutrient-sdk/dws-mcp-server without pinning a specific version. This creates a supply-chain risk: the package resolved at runtime could change unexpectedly or be compromised, and the skill is specifically positioned to process sensitive local documents, increasing the consequences of malicious package updates.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The HTML-to-PDF example uploads local content to an external API endpoint. Even though this is the intended service model, it creates a genuine external transmission risk because documents may contain secrets, internal URLs, embedded tokens, or proprietary content that leaves the local environment.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

HTML to PDF:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "index.html=@index.html" \
  -F 'instructions={"parts":[{"html":"index.html"}]}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The DOCX-to-PDF workflow sends a local Office document to a remote service for processing. This can expose confidential business content, tracked changes, comments, hidden metadata, or embedded objects if the skill is triggered on sensitive files.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

DOCX to PDF:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.docx=@document.docx" \
  -F 'instructions={"parts":[{"file":"document.docx"}]}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The PDF conversion example uploads the source PDF externally for transformation into another format. Because PDFs often contain sensitive text, annotations, forms, or attachments, this is a real confidentiality boundary and can lead to unauthorized third-party exposure if used casually by an agent.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

PDF to DOCX/XLSX/PPTX:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"output":{"type":"docx"}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The image-to-PDF example sends local images to an external API. Images may contain personal data, credentials, screenshots, IDs, or other sensitive visual content, so remote upload is a substantive security and privacy concern even if the endpoint is legitimate.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

Image to PDF:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "image.jpg=@image.jpg" \
  -F 'instructions={"parts":[{"file":"image.jpg"}]}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The plain-text extraction workflow uploads documents and returns extracted text, which can materially amplify data exposure by converting complex files into easily searchable plaintext. In an agent environment, this increases the risk of accidental disclosure of confidential contents to external services and downstream toolchains.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

Extract plain text:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"output":{"type":"text"}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The table extraction example uploads documents to a remote service and outputs structured data such as spreadsheets. Structured extraction increases sensitivity because internal financial, HR, medical, or operational data becomes easier to analyze and exfiltrate once normalized.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

Extract tables (as JSON, CSV, or Excel):

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"output":{"type":"xlsx"}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Key-value extraction sends documents externally and derives structured fields that may include account numbers, identities, addresses, or other sensitive records. This is more dangerous than simple conversion because it transforms potentially private document contents into machine-friendly data suitable for automation or misuse.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

Extract key-value pairs:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"extraction","strategy":"key-values"}]}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

OCR of scanned files requires transmission of the scanned document or image to an external service. Since scanned inputs often contain passports, contracts, medical forms, or handwritten notes, this creates a meaningful privacy and confidentiality risk.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

Apply OCR to scanned PDFs or images, producing searchable PDFs with selectable text.

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "scanned.pdf=@scanned.pdf" \
  -F 'instructions={"parts":[{"file":"scanned.pdf"}],"actions":[{"type":"ocr","language":"english"}]}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

Pattern-based redaction still requires uploading the original unredacted document to the external API, so the service sees the sensitive data before it is redacted. This can create a false sense of safety because users may believe the operation protects secrecy while the raw source has already left the local environment.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

Pattern-based redaction (preset patterns):

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"redaction","strategy":"preset","preset":"social-security-number"}]}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

Regex-based redaction also transmits the original unredacted document to a third party. Because users may use custom regexes to target secrets, IDs, or proprietary identifiers, the skill facilitates remote handling of exactly the kinds of sensitive data they are trying to protect.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

Regex-based redaction:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"redaction","strategy":"regex","regex":"\\b[A-Z]{2}\\d{6}\\b"}]}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

AI-powered PII redaction is especially sensitive because it uploads documents specifically to identify personally identifiable information. That means the external service receives potentially high volumes of sensitive personal data, and the natural-language criteria may encourage broad scanning of confidential records.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

AI-powered PII redaction:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"ai_redaction","criteria":"All personally identifiable information"}]}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The watermarking example sends a PDF externally for modification. While generally less sensitive than extraction, it still transmits the full source document to a third party, which may be problematic for confidential or internal materials.

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

Text watermark:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"watermark","text":"CONFIDENTIAL","fontSize":48,"fontColor":"#FF0000","opacity":0.5,"rotation":45,"width":"50%","height":"50%"}]}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Image watermarking transmits both the source PDF and watermark image to the external API. If either contains confidential branding assets, internal documents, or sensitive imagery, this creates third-party exposure beyond the local environment.

Content

Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.

Image watermark:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F "logo.png=@logo.png" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Digital-signature workflows upload documents intended for signing to an external service, which is highly sensitive because signed documents often carry legal, financial, or contractual significance. Depending on the signing model, this may also create integrity and trust-boundary concerns if users do not fully understand where signing operations occur.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

Sign a PDF with CMS signature:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"sign","signatureType":"cms","signerName":"John Doe","reason":"Approval","location":"New York"}]}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Long-term validation signing similarly transmits potentially sensitive legal documents to a remote service. Because these workflows imply stronger evidentiary and compliance properties, misuse or misunderstanding of the external trust boundary can have significant legal and security consequences.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

Sign with CAdES-B-LT (long-term validation):

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf"}],"actions":[{"type":"sign","signatureType":"cades","cadesLevel":"b-lt","signerName":"Jane Smith"}]}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

Form filling uploads the original form and the field values, which commonly contain names, email addresses, addresses, tax IDs, or other sensitive user-supplied data. This is a material privacy risk because both the template and the populated personal data are sent to a third party.

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

Fill PDF form fields using Instant JSON format:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "form.pdf=@form.pdf" \
  -F 'instructions={"parts":[{"file":"form.pdf"}],"actions":[{"type":"fillForm","fields":[{"name":"firstName","value":"John"},{"name":"lastName","value":"Doe"},{"name":"email","value":"john@example.com"}]}]}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Merging PDFs uploads multiple source documents to an external service in a single request. This can compound data exposure by aggregating separate confidential files into one remote processing event.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

Merge multiple PDFs:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "doc1.pdf=@doc1.pdf" \
  -F "doc2.pdf=@doc2.pdf" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Page extraction still requires uploading the entire source PDF to the remote API, even if only selected pages are returned. Users may incorrectly assume that only the specified pages are disclosed, when the complete file may be accessible to the service during processing.

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

Extract specific pages:

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf","pages":{"start":0,"end":4}}]}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Rendering a page as an image transmits the source PDF to the external service. Even if only one page is requested in output, the remote processor may still receive the full document, creating a confidentiality boundary users might overlook.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

9. Render PDF Pages as Images

bash
curl -X POST https://api.nutrient.io/build \
  -H "Authorization: Bearer $NUTRIENT_API_KEY" \
  -F "document.pdf=@document.pdf" \
  -F 'instructions={"parts":[{"file":"document.pdf","pages":{"start":0,"end":0}}],"output":{"type":"png","dpi":300}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.

10. Check Credits

bash
curl -X GET https://api.nutrient.io/credits \
  -H "Authorization: Bearer $NUTRIENT_API_KEY"

Static analysis

No suspicious patterns detected.