ClawHub
Back to skill

Security audit

Pdf To Ppt

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it converts a user-chosen PDF into page images and a PowerPoint file, with no hidden network, credential, or persistence behavior found.

Before installing dependencies, use a virtual environment instead of the documented --break-system-packages command, and choose custom output/image directories if you want to avoid writing next to the source PDF or overwriting existing generated files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:113
Finding
Unpinned Dependency Installation Bypasses System Python Protections<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 113–116 **Vulnerability Type**: Unpinned and system-wide third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip install --break-system-packages PyMuPDF python-pptx ``` ### Technical Analysis The troubleshooting instructions recommend installing `PyMuPDF` and `python-pptx` without fixed versions or integrity hashes. Consequently, package resolution depends on whichever releases and transitive dependencies are available from the configured package index at installation time. The effective dependency code can therefore change after the Skill has been reviewed. The `--break-system-packages` option bypasses Python's externally managed environment protection. If the command is run with sufficient filesystem permissions, pip may alter an operating-system-managed Python environment, overwrite compatible package versions, or introduce dependency conflicts affecting other applications. Exploitation depends on a dependency, transitive dependency, configured package index, or package-distribution channel being compromised or otherwise supplying an unsafe release. The command does not itself grant elevated privileges; installed code executes with the privileges of the user running pip and later running the converter. ### Attack Path 1. A user encounters the documented missing-module error and follows the troubleshooting command. 2. Pip queries the user's configured package index and resolves mutable, unpinned versions of `PyMuPDF`, `python-pptx`, and their dependencies. 3. A compromised or unexpectedly malicious release is selected, downloaded, and installed without hash verification. 4. Package-controlled installation or build logic may execute with the invoking user's privileges. 5. The installed package code is subsequently imported by `scripts/pdf_to_ppt.py`, providing another execution opportunity. 6. Because externally managed environment safeguards wer ...[truncated 842 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove `--break-system-packages` and install dependencies in an isolated virtual environment: ```bash python3 -m venv .venv . .venv/bin/activate python -m pip install --upgrade pip python -m pip install -r requirements.txt ``` 2. Pin all direct and transitive dependencies to reviewed versions in a lock file. 3. Require package hashes, for example by generating a hash-locked requirements file and installing with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use a trusted, explicitly configured package index and HTTPS certificate verification. 5. Periodically review and update pinned dependencies through a controlled process that includes vulnerability scanning and functional testing. 6. Document that installation should occur as an unprivileged user and must not be performed with `sudo` or administrator privileges. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
91% confidence
Finding
The markdown explains that the skill creates an `images/` subdirectory and generates a `.pptx` file, but it does so as a neutral workflow description rather than an explicit user warning about filesystem changes. For a skill that writes multiple files, a brief notice about creating intermediate artifacts and output files would better disclose the behavior's impact on user data/storage.

Static analysis

No suspicious patterns detected.