ClawHub
Back to skill

Security audit

Work Productivity Nano Pdf Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only workflow helper with overly broad activation wording, but I found no hidden execution, persistence, credential access, or data exfiltration behavior.

Install only if you want a generic Nano Pdf-style workflow helper. Be aware that its broad keywords and implicit invocation may activate it for ordinary PDF, editing, or workflow requests, so confirm the selected skill when the task is unrelated.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use the skill when a user asks for broad categories like "work-productivity," "pdf," "edit," or any "practical workflow, artifact, checklist, analysis, or implementation support," which is too ambiguous to safely determine intended activation. This can make the skill match a large portion of normal requests, causing misrouting and exposing users to irrelevant or conflicting instructions.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger keywords are extremely broad, including generic terms like "nano," "pdf," "edit," "natural," and "language," which can cause the skill to activate for many unrelated user requests. Overbroad activation increases the chance of unintended routing, prompt/context injection into irrelevant tasks, and unsafe interference with other skills or workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger list is excessively broad and includes generic terms like “nano”, “pdf”, “edit”, “natural”, and “language”, which are likely to appear in many unrelated requests. This can cause unintended activation of the skill, routing users into the wrong workflow and potentially producing irrelevant or unsafe assistance in contexts the skill was not meant to handle.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger phrases are written so broadly that they can match ordinary requests containing generic terms like "workflow," "pdf," "edit," or "help me," causing the skill to activate outside its intended scope. In an agent routing system, this can lead to misselection, prompt hijacking of unrelated tasks, and accidental exposure of users to irrelevant or lower-safety behavior paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The invocation guidance defines a wide keyword surface and vague trigger boundaries, making it unclear what input should activate the skill versus when normal conversation should be handled without it. In a productivity/PDF context, this can lead to accidental skill execution, workflow confusion, and potentially unnecessary exposure of user documents or task context to an unintended skill pipeline.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger sentence is phrased as a common natural-language request and includes broad wording that could plausibly appear in ordinary user conversation. In agent systems that auto-activate skills from loose matching, this increases the chance of unintended invocation, causing the wrong workflow to run or sensitive user content to be routed into this skill unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad, natural-language prompts that overlap with ordinary user requests, which can cause the skill to activate unintentionally outside a narrowly scoped PDF workflow. In an agent environment, over-broad invocation increases the chance of prompt-routing mistakes, unexpected execution paths, and misuse of the skill in contexts the user did not explicitly intend.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The example trigger phrases are vague and repetitive, effectively suggesting activation from generic help requests without meaningful distinguishing criteria. Poor examples reinforce overbroad matching behavior and make it more likely that orchestration systems or users invoke the skill in unintended contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description defines activation using a very broad set of user intents—practical workflow, artifact, checklist, analysis, or implementation support—combined with common terms like work-productivity and pdf. This weak scoping increases the chance the skill is invoked for loosely related tasks, creating misrouting and overreach risks, especially in automated agent environments.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The default prompt is overly broad and written in generic natural-language terms, which increases the chance of unintended or implicit invocation during ordinary user conversation. Because the skill also allows implicit invocation, unrelated requests about productivity, PDFs, or workflow help could trigger this skill unexpectedly, expanding the attack surface and enabling prompt/context injection pathways the user did not explicitly request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

该文件是中文说明文档，但 L05 使用英文完整描述需求，L32 也以英文说明技能用途，体现出面向中文读者时未提供一致的语言选择或本地化内容。根据语言/locale 政策，若未说明用户可选择语言，则这种默认强制英文呈现可能构成策略问题。

Content

No source excerpt is available for this finding.