ClawHub
Back to skill

Security audit

PDF Reader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local PDF-to-Markdown converter; the main considerations are normal dependency and external-tool trust, not hidden data access or persistence.

Install dependencies only from trusted package sources, consider pinning or skipping the optional markitdown fallback, and run the skill only on PDFs and output paths you choose. Treat OCR output as approximate and review the script's warnings before relying on extracted numbers or dates.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:66
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:66-68, README.en.md:29-32, README.en.md:37-40, README.md:40-43, and README.md:48-51
Vulnerability Type: Unpinned third-party dependency and supply-chain risk
Risk Level: Medium

The installation instructions recommend installing markitdown[pdf] without a fixed version or integrity hash.

Relevant code snippets:

SKILL.md:66-68

bash
brew install poppler                      # pdftotext / pdffonts / pdftoppm / pdfinfo
brew install tesseract tesseract-lang     # OCR + chi_sim Chinese package
uv tool install "markitdown[pdf]"         # Fallback engine

README.en.md:29-32

bash
brew install poppler
brew install tesseract tesseract-lang
uv tool install "markitdown[pdf]"

README.en.md:37-40

bash
sudo apt-get update
sudo apt-get install -y poppler-utils tesseract-ocr tesseract-ocr-chi-sim tesseract-ocr-eng
pipx install "markitdown[pdf]"

README.md:40-43

bash
brew install poppler
brew install tesseract tesseract-lang
uv tool install "markitdown[pdf]"

README.md:48-51

bash
sudo apt-get update
sudo apt-get install -y poppler-utils tesseract-ocr tesseract-ocr-chi-sim tesseract-ocr-eng
pipx install "markitdown[pdf]"

The installed command is subsequently trusted and executed by scripts/pdf2md.py:119-124:

python
def extract_markitdown(pdf, first, last):
    if first or last:
        raise RuntimeError("markitdown does not support page ranges; use the pdftotext or ocr engine")
    need("markitdown", "uv tool install 'markitdown[pdf]'")
    r = run(["markitdown", str(pdf)])
    if r.returncode != 0:
        raise RuntimeError(f"markitdown failed: {r.stderr.strip()[:200]}")

Technical Analysis

Neither uv tool install "markitdown[pdf]" nor pipx install "markitdown[pdf]" constrains the dependency to a reviewed version. The package installer may theref ...[truncated 2224 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin markitdown to a specific, reviewed version in every installation example, such as markitdown[pdf]==<reviewed-version>.
  2. Generate and maintain a lock file that constrains all transitive dependencies, not only the top-level package.
  3. Use hash-verified installation artifacts where the selected package-management workflow supports them.
  4. Document the expected package registry and publisher so users can verify that the dependency was obtained from the intended source.
  5. Review and test dependency updates before changing the documented pin; consider automated vulnerability and provenance scanning in CI.
  6. Keep markitdown optional and isolated in a dedicated virtual environment or tool environment with only the permissions needed for PDF conversion.
  7. Replicate the corrected, pinned command consistently in SKILL.md, README.en.md, and README.md.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.en.md (reported line 38)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt-get update
sudo apt-get install -y poppler-utils tesseract-ocr tesseract-ocr-chi-sim tesseract-ocr-eng
pipx install "markitdown[pdf]"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.en.md (reported line 39)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt-get update
sudo apt-get install -y poppler-utils tesseract-ocr tesseract-ocr-chi-sim tesseract-ocr-eng
pipx install "markitdown[pdf]"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt-get update
sudo apt-get install -y poppler-utils tesseract-ocr tesseract-ocr-chi-sim tesseract-ocr-eng
pipx install "markitdown[pdf]"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt-get update
sudo apt-get install -y poppler-utils tesseract-ocr tesseract-ocr-chi-sim tesseract-ocr-eng
pipx install "markitdown[pdf]"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill explicitly instructs running a local Python script and writing output files, but it declares no permission or allowed-tools scope. In an agent ecosystem, missing tool scoping weakens containment and can let the skill be invoked with broader shell/file-write capabilities than users or orchestrators expect, increasing the blast radius if the script is modified, compromised, or misused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description says the skill should be used when the user asks to "读 PDF" or "提取 PDF 文字／内容", and also when other workflows need PDF material converted to markdown. These triggers are broad natural-language phrases without clear exclusion conditions, which could cause the skill to activate for general PDF-reading or content-extraction requests beyond the intended narrow conversion workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code file contains natural-language descriptions, help text, and runtime messages entirely in Chinese, which imposes a specific language on users. Under the policy, locale/language constraints should offer user choice or be explicitly justified as region-specific; neither is present here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/pdf2md.py (reported line 39)May include surrounding context.

python
def run(cmd):
    return subprocess.run(cmd, capture_output=True, text=True)


def need(tool, hint):

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The short description is in Chinese while the default prompt is in English, which implies a language expectation without any user opt-in or documented locale justification. This can violate language/locale policy expectations because the skill does not state whether output language is fixed or user-selectable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.