Security audit
Security checks for vulnerabilities and agentic risk
This skill openly uses Shelv's remote API to upload selected PDFs and download Markdown results, with privacy and overwrite risks but no hidden or deceptive behavior found.
Install only if you are comfortable sending selected PDFs to Shelv's remote service with your Shelv API key. Avoid uploading confidential or regulated documents unless your organization approves that processing, and review shelf IDs carefully before any delete, approve, regenerate, or --force hydrate operation.
The upload workflow sends local PDFs to an external service and creates a remote resource, but the declared purpose suggests local conversion and workspace hydration. In the context of potentially sensitive contracts, books, or research papers, this is dangerous because users may unintentionally disclose confidential data to a third party.
The upload workflow sends local PDFs to an external service and creates a remote resource, but the declared purpose suggests local conversion and workspace hydration. In the context of potentially sensitive contracts, books, or research papers, this is dangerous because users may unintentionally disclose confidential data to a third party.
The upload workflow sends local PDFs to an external service and creates a remote resource, but the declared purpose suggests local conversion and workspace hydration. In the context of potentially sensitive contracts, books, or research papers, this is dangerous because users may unintentionally disclose confidential data to a third party.
The documented DELETE /v1/shelves/{shelfPublicId} endpoint enables permanent removal of user resources, and in an agent-integrated environment this is a classic tool-parameter abuse surface: if an LLM is induced to supply or substitute a shelf ID, it could delete the wrong resource. The danger is amplified because the API reference presents the operation tersely, without guardrails like confirmation requirements, ownership checks in the client flow, or examples emphasizing safe handling.
DELETE /v1/shelves/{shelfPublicId}
Response (200):
This script uploads arbitrary local PDF contents to an external service at api.shelv.dev, which directly contradicts the stated local filesystem-conversion purpose and creates a meaningful data exfiltration path. In an agent skill context, this is more dangerous because users may invoke the tool on confidential workspace documents expecting only local processing, while the entire file is transmitted off-host.
The README instructs users to upload arbitrary PDFs to an external third-party service but does not clearly warn that document contents will leave the local environment and be processed remotely. Because PDFs commonly contain contracts, research, or regulated/sensitive data, this omission can cause accidental disclosure by users who assume the operation is local.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Setup
1. Create a Shelv account at [shelv.dev](https://shelv.dev)
2. Generate an API key at **Settings > API Keys**
3. Set the `SHELV_API_KEY` environment variable before running any commands:
The skill declares shell-capable behavior but does not specify an explicit tool scope such as allowed tools or permissions. That increases the chance the agent can invoke shell operations beyond what users expect, especially because the documented workflows include network access, file writes, extraction, and overwrite behavior.
The documentation describes uploading PDFs and hydrating results locally without clearly warning that document contents leave the system and are later written as files into the workspace. For a skill handling potentially sensitive documents, omission of this warning creates a meaningful risk of unintended disclosure and local persistence.
This endpoint uploads a local PDF to an external service using bearer-token authentication. Because the skill is specifically used for contracts, books, research papers, and regulations, the transmitted content may be sensitive, making external transmission a real security and privacy concern.
Inline alternative (without the script):
curl -X POST "https://api.shelv.dev/v1/shelves" \
-H "Authorization: Bearer $SHELV_API_KEY" \
-F "file=@document.pdf" \
-F "name=My Document"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Inline alternative:
curl -s "https://api.shelv.dev/v1/shelves/$SHELF_ID" \
-H "Authorization: Bearer $SHELV_API_KEY" | jq '.status'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Inline alternative:
curl -s "https://api.shelv.dev/v1/shelves/$SHELF_ID" \
-H "Authorization: Bearer $SHELV_API_KEY" | jq '.status'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Inline alternative:
curl -s "https://api.shelv.dev/v1/shelves/$SHELF_ID" \
-H "Authorization: Bearer $SHELV_API_KEY" | jq '.status'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Inline alternative:
curl -s "https://api.shelv.dev/v1/shelves/$SHELF_ID" \
-H "Authorization: Bearer $SHELV_API_KEY" | jq '.status'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Inline alternative:
curl -s "https://api.shelv.dev/v1/shelves/$SHELF_ID" \
-H "Authorization: Bearer $SHELV_API_KEY" | jq '.status'
The force-overwrite mode allows replacement of an existing local shelf directory, but the docs do not emphasize the risk of destroying or replacing previously hydrated data. In a workspace-oriented skill, overwrite behavior can lead to accidental data loss or masking of trusted content with newly downloaded remote content.
Fetching the tree exposes a full path map of the processed document content from the external service, which may reveal sensitive structure or subject matter even without downloading the archive. In this skill context, remote retrieval of document-derived data is security-relevant and should be treated as a disclosure surface.
Get the file tree (flat JSON map of path → content):
curl -s "https://api.shelv.dev/v1/shelves/$SHELF_ID/tree" \
-H "Authorization: Bearer $SHELV_API_KEY" | jq '.files | keys[]'
Reading an individual file retrieves processed document content from the third-party service over the network. This is expected functionality, but it still constitutes external handling of potentially sensitive document contents and should be clearly disclosed.
Read a single file by path (useful for targeted lookups without downloading the full archive):
curl -s "https://api.shelv.dev/v1/shelves/$SHELF_ID/files/README.md" \
-H "Authorization: Bearer $SHELV_API_KEY"
This is another direct remote file-content retrieval path, and the same confidentiality concerns apply because the content originates from user documents processed by a third party. The risk is heightened by the skill’s framing as local exploration, which may understate the remote nature of access.
```bash
curl -s "https://api.shelv.dev/v1/shelves/$SHELF_ID/files/clauses/force-majeure.md" \
-H "Authorization: Bearer $SHELV_API_KEY"
Hydrated shelves are persisted under the user workspace, meaning document-derived content remains on disk across the session. In combination with remote processing and force-overwrite support, this can create an unexpected local data retention risk for sensitive document contents.
The `{name}` is derived from the shelf's display name (lowercased, spaces and special characters replaced with hyphens). Override with `--name` when hydrating.
If a directory already exists at the target path, the script will refuse to overwrite it unless `--force` is passed.
After hydration, use standard Unix tools to explore:
The API reference documents destructive and state-changing operations such as deleting a shelf and approving or modifying shelf contents, but it does not include explicit warnings, confirmation guidance, or safety notes about irreversible effects. In an agent skill context, this increases the chance that an LLM-driven tool invocation could perform unintended destructive actions on user data without clear user awareness.
This is a markdown file, so SQP-2 applies to missing warnings in the skill description. Line L061 states that approval can apply file operations such as rename, delete, mkdir, and write, but the document does not explicitly warn users that approval may modify or delete files and affect stored data.
This code performs a destructive operation by recursively removing the existing workspace directory when --force is supplied. Although there is a warning message, there is no confirmation prompt, and the usage text does not clearly emphasize the irreversible deletion behavior of --force.
The skill metadata promises local workspace hydration and exploration with standard Unix tools, but this script is explicitly designed to send the user’s PDF to a remote Shelv API service. That mismatch is security-relevant because users may provide sensitive local documents under the assumption that processing is local, leading to unintended external disclosure.
The script’s output and usage messaging describe an upload operation, but they do not provide a prominent security warning that a local document and bearer-authenticated request are being sent to an external service. While the API key is placed in an Authorization header rather than printed, the lack of explicit warning can still mislead users about the privacy and trust implications of running the skill.
No suspicious patterns detected.