Nano Pdf 1.0.0

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:33 AM UTC
• Version: 1.0.0

Overview

This skill is a small, disclosed wrapper for installing and using the nano-pdf CLI, with the main caution being an unpinned external package.

Install this only if you are comfortable trusting the nano-pdf package from PyPI. Review generated PDFs before sharing them, and prefer using the tool in a restricted environment for sensitive documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"📄","requires":{"bins":["nano-pdf"]},"install":[{"id":"uv","kind":"uv","package":"nano-pdf","bins":["nano-pdf"],"label":"Install nano-pdf (uv)"}]}}

Technical Analysis

The installation configuration directs the framework to install the third-party nano-pdf package through uv without specifying an exact version, package hash, lockfile, or immutable artifact reference. Consequently, the code installed in the future may differ from the package version available when this Skill was reviewed.

The project contains no source code for the dependency, so its installation hooks and runtime behavior cannot be audited from the supplied artifact. This creates a supply-chain trust boundary in which a compromised package maintainer account, malicious future release, or upstream distribution compromise could introduce attacker-controlled code. There is no evidence in the audited files that the current PyPI package is malicious; the finding concerns the unsafe dependency-resolution configuration.

Attack Path

1. An attacker compromises the upstream package, its maintainer account, or the relevant package-distribution infrastructure.
2. The attacker publishes a malicious release under the expected nano-pdf package name.
3. The Skill installation process resolves the unpinned package specification to that attacker-controlled release.
4. Package-controlled installation or build logic executes during installation, or malicious code executes when the Agent invokes the nano-pdf CLI.
5. The malicious dependency operates with the privileges of the installation or runtime user and may access inputs, including PDFs and natural-language editing instructions available to the process.

Impact Assessment

Successful exploitation ...[truncated 640 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin nano-pdf to an exact version that has undergone security review rather than allowing unconstrained resolution.
2. Record and verify cryptographic hashes for the package and all transitive dependencies using a reproducible lockfile or equivalent integrity mechanism.
3. Prefer an immutable, trusted artifact repository and retain the dependency source or software bill of materials for review.
4. Audit package installation hooks, entry points, and transitive dependencies before deployment.
5. Execute installation and PDF processing inside a restricted sandbox or container using a dedicated, unprivileged account.
6. Deny unnecessary network access and prevent the process from accessing secrets, unrelated user files, and sensitive environment variables.
7. Revalidate the pinned artifact and its hashes as part of dependency-update and release-review procedures.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.