ClawHub
Back to skill

Security audit

Pdf

Security checks for vulnerabilities and agentic risk

Overview

This is a local PDF-processing skill with some caution-worthy examples, but no hidden persistence, exfiltration, or unrelated behavior was found.

Install only if you are comfortable letting the agent process PDFs you provide and write derived files in paths you choose. Use copied PDFs or new output filenames, handle PDF passwords as sensitive data, decrypt only documents you own or are authorized to access, and install optional OCR dependencies in a virtual environment with reviewed versions where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:215
Finding

Unpinned Third-Party Package Installation Instruction

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 215
Vulnerability Type: Unpinned third-party dependencies installed from a mutable package repository
Risk Level: Low

Code Snippet:

python
### Extract Text from Scanned PDFs
```python
# Requires: pip install pytesseract pdf2image
import pytesseract
from pdf2image import convert_from_path

Technical Analysis

The OCR example instructs users to install pytesseract and pdf2image without pinning reviewed versions or verifying package hashes. No dependency lockfile, trusted package index, or integrity-verification procedure is provided.

Consequently, the packages resolved by pip can change after the Skill has been audited. Python package installation may execute package build or installation logic, while imported packages execute code with the privileges of the current Python process. This creates a supply-chain exposure if a named distribution, its maintainer account, release infrastructure, or configured package index is compromised.

The reviewed instruction names established packages and does not exhibit direct evidence of typosquatting or an intentionally malicious source. The vulnerability is therefore conditional and rated Low rather than being treated as evidence of active malicious behavior.

Attack Path

  1. An attacker compromises a referenced package, a maintainer account, its release channel, or a package index configured on the target system.
  2. The attacker publishes a malicious package release under one of the referenced names.
  3. A user follows the unpinned pip install pytesseract pdf2image instruction.
  4. pip resolves the mutable malicious release because no approved version or hash is enforced.
  5. Malicious code executes during package installation, import, or subsequent OCR processing with the privileges of the invoking user.

Impact Assessment

Successful exploitation could execute arbitrary code wi ...[truncated 499 chars]

Remediation
View remediation

Remediation Suggestions

  1. Move dependencies into a reviewed requirements file and pin exact versions.

  2. Record cryptographic hashes and require verification during installation, for example:

    text
    pip install --require-hashes -r requirements.txt

  3. Generate and review a lockfile through a dependency-management tool such as pip-tools.

  4. Document an explicitly trusted package index and disable unintended fallback indexes where appropriate.

  5. Install dependencies in a dedicated virtual environment or container under a non-privileged account.

  6. Continuously scan pinned dependencies for known vulnerabilities and review version updates before changing the lockfile.

  7. Avoid recommending installation with administrator or root privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The supplied code chunk does not implement a comprehensive PDF manipulation toolkit. It is a test file for a helper function get_bounding_box_messages, using synthetic JSON streams to verify bounding-box overlap and height-validation behavior for form fields. While this may be tangentially related to PDF form handling, the actual code here is limited to testing validation logic and does not perform text/table extraction, PDF creation, merging/splitting, or large-scale PDF processing. That makes the chunk's primary purpose materially narrower and different from the declared description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explicitly includes qpdf --password=... --decrypt, which enables removal of PDF password protection. While such functionality can be legitimate for owner-authorized recovery or workflow automation, documenting it without clear authorization constraints broadens the skill toward bypassing access controls and can facilitate misuse against protected documents.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest describes a PDF manipulation toolkit for extracting text and tables, creating PDFs, merging/splitting, and handling forms. This section adds OCR using pytesseract and pdf2image, which is a separate image-based text-recognition capability rather than ordinary PDF processing and is not mentioned in the stated scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This markdown file directs the user to create field_values.json and generate a filled output PDF, which affects local user data. The instructions do not include any warning to use a new output path, avoid overwriting important files, or verify backups before writing artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The instructions culminate in fill_pdf_form_with_annotations.py creating a filled-out PDF from the source document and field data. Although the command shows an output path, the markdown does not explicitly warn that this operation produces a modified document and should be directed to a safe output location.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This is a markdown file, so SQP-2 applies to omitted warnings in the skill description. The section includes explicit decryption commands and a hardcoded password example, but provides no caution that passwords are sensitive or that decrypting protected PDFs may affect security or document handling expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The markdown includes a code example that calls reader.decrypt("password") but does not warn readers that passwords should be handled securely and not embedded directly in code. For markdown guidance, SQP-2 applies when descriptions omit warnings about behavior that could affect privacy or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code performs a file write that changes user data by creating the filled PDF, but the operation has no confirmation prompt or user-facing disclosure at the write site. The brief file header comment describes the purpose, yet it does not warn that running the script will write a new PDF to the specified output path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.