ClawHub
Back to skill

Security audit

pdftk Server

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward PDF command-reference skill with some security caveats, but I found no hidden, deceptive, or purpose-mismatched behavior.

Install only if you are comfortable using PDFtk on local PDFs. Avoid putting real PDF passwords directly in shell commands, treat decrypted files and extracted attachments as sensitive, prefer modern encryption tools for confidential documents, and verify any source archive before building it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:80
Finding

PDF Passwords Exposed Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/pdftk-cli-examples.md:80
Finding

Obsolete RC4 Encryption Presented as a Document-Protection Workflow

Content
View full analysis
| `encrypt_40bit` | Apply 40-bit RC4 encryption | | `encrypt_128bit` | Apply 128-bit RC4 encryption (default when password set) | ``` ### Technical Analysis The documentation presents 40-bit RC4 as an available encryption workflow without clearly warning that it is obsolete and unsuitable for protecting sensitive information. A 40-bit key space is within practical brute-force range, and RC4 is a deprecated cipher with well-established weaknesses. The manual also identifies the 128-bit mode as RC4. While stronger than the 40-bit mode in key length, RC4-based PDF encryption remains a legacy choice and should not be represented as modern protection for confidential documents. PDF permission flags and owner-password restrictions should also not be treated as strong access-control boundaries. Their enforcement depends on PDF readers, and compliant or noncompliant software may ignore document restrictions after decryption. ### Attack Path 1. A user follows the documented `encrypt_40bit` example to protect a confidential PDF. 2. The encrypted PDF is shared, intercepted, leaked, or otherwise acquired by an attacker. 3. The attacker applies password guessing, brute-force tooling, or legacy PDF password-recovery techniques against the weak encryption. 4. The attacker recovers access to the PDF contents or removes its document restrictions. 5. The attacker reads, copies, modifies, or redistributes information that the user believed was securely protected. ### Impact ...[truncated 444 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
references/download.md:55
Finding

Downloaded Source Archive Is Built Without Cryptographic Integrity Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md
- [pdftk-man-page.md](references/pdftk-man-page.md) - Complete manual reference with all operations, options, and syntax

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown skill description includes privacy-impacting behaviors such as decrypting PDFs and extracting embedded files, but it does not warn users that these actions may reveal protected content or recover sensitive attachments onto disk. Under the markdown criteria for missing user warnings, descriptions should disclose behaviors that could affect user data or privacy.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
- PDFtk Server must be installed on the system
  - **Windows**: `winget install --id PDFLabs.PDFtk.Server`
  - **macOS**: `brew install pdftk-java`
  - **Linux (Debian/Ubuntu)**: `sudo apt-get install pdftk`
  - **Linux (Red Hat/Fedora)**: `sudo dnf install pdftk`
- Access to a terminal or command prompt
- Verify installation by running `pdftk --version`

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
- PDFtk Server must be installed on the system
  - **Windows**: `winget install --id PDFLabs.PDFtk.Server`
  - **macOS**: `brew install pdftk-java`
  - **Linux (Debian/Ubuntu)**: `sudo apt-get install pdftk`
  - **Linux (Red Hat/Fedora)**: `sudo dnf install pdftk`
- Access to a terminal or command prompt
- Verify installation by running `pdftk --version`

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/download.md (reported line 26)May include surrounding context.

On Debian/Ubuntu-based distributions:

bash
sudo apt-get install pdftk

On Red Hat/Fedora-based distributions:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/download.md (reported line 32)May include surrounding context.

On Debian/Ubuntu-based distributions:

bash
sudo apt-get install pdftk

On Red Hat/Fedora-based distributions:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file includes commands to remove PDF encryption and later to extract embedded attachments, both of which can affect protected content and expose user data. The examples present these operations as straightforward commands without any warning about authorization, sensitivity of decrypted files, or risks from unpacking embedded files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This file is markdown, so SQP-2 applies to descriptions that omit warnings about behaviors affecting user data or privacy. The unpack_files example explicitly extracts embedded files to disk, and nearby sections also describe exporting metadata, but the document provides no caution that these outputs may contain sensitive information from the source PDF.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
75% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · references/pdftk-man-page.md (reported line 223)May include surrounding context.

md
| `ScreenReaders` | Allow screen reader access |
| `ModifyAnnotations` | Allow annotation modification |
| `FillIn` | Allow form fill-in |
| `AllFeatures` | Grant all permissions |

## Key Notes

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/third-party-materials.md (reported line 57)May include surrounding context.

md
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Download the Bouncy Castle source code from: http://www.bouncycastle.org/.

Static analysis

No suspicious patterns detected.