pdftk Server

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only PDFtk reference for local PDF manipulation, with disclosed command-line and install steps and no hidden code or exfiltration evident.

Before installing, make sure PDFtk comes from a trusted source, expect possible admin privileges for setup, and only let the agent run commands on PDFs and passwords you intentionally provide. Double-check file paths and review outputs before sharing them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If run with the wrong inputs or paths, the agent could create unwanted PDF outputs, remove pages from a generated copy, expose metadata, or extract embedded files.

Why it was flagged

The skill documents direct command-line operations that read local PDFs and create modified output files. This is the stated purpose, but it should remain user-directed.

Skill content
pdftk input.pdf cat 1-5 10-15 output extracted.pdf ... pdftk form.pdf fill_form data.fdf output filled.pdf flatten
Recommendation

Confirm input files, output paths, and intended PDF changes before running commands, and review generated files before sharing them.

What this means

A PDF password provided in chat or a shell command could be visible in conversation history, command history, or local process listings depending on how it is run.

Why it was flagged

The skill shows PDF passwords being supplied to pdftk on the command line. That is expected for decrypting protected PDFs, but document passwords are sensitive.

Skill content
pdftk secured.pdf input_pw mypassword output unsecured.pdf
Recommendation

Only provide PDF passwords for documents you are authorized to access, avoid reusing real passwords in examples, and prefer secure prompting or careful local handling where possible.

What this means

Installing or building PDFtk changes the local system and may require administrator privileges.

Why it was flagged

The skill includes external package installation and optional source download/build instructions. These are purpose-aligned setup steps, but they rely on external software provenance.

Skill content
sudo apt-get install pdftk ... curl -LO https://www.pdflabs.com/tools/pdftk-the-pdf-toolkit/pdftk-2.02-src.zip ... make -f Makefile.Debian
Recommendation

Use trusted OS package managers or official PDFtk sources, review installer prompts, and verify downloads or packages when possible.