T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pdf2md.py:7- Finding
Unrestricted Remote PDF Retrieval Enables Server-Side Request Forgery and Resource Exhaustion
- Content
View full analysis
- Remediation
View remediation
Security audit
PDF 知识提取技能
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its PDF conversion purpose, but it includes under-scoped remote fetching and an undocumented script that reads another OpenClaw workspace path.
Review carefully before installing. Use this only in an isolated virtual environment with trusted local PDFs or trusted URLs, avoid running it on hosts with access to sensitive internal network services, and remove or disable decode_files.py unless you explicitly need that workspace metadata utility. Pin dependencies before installation.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pdf2md.py:14- Finding
Predictable Temporary PDF Path Permits a Local Symlink Race
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:102- Finding
Unpinned Third-Party Dependency Installation Creates Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
decode_files.py:4- Finding
Undocumented Script Reads Metadata from an External OpenClaw Workspace
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description centers on PDF ingestion and knowledge extraction workflows. The supplied code does not open or parse PDFs, convert content to Markdown, repair CJK spacing, or extract knowledge from document bodies. Instead, it merely enumerates existing .md files in a specific hardcoded directory and prints a few metadata values from their headers. This is a materially different and much narrower behavior than the declared purpose, so it is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
该代码块的主要功能是对Markdown文本进行规则抽取，而不是处理PDF。声明描述强调这是一个“PDF知识提取技能”，并列出四项功能，其中前两项（PDF转Markdown、CJK间距修复）在代码中完全没有体现；输入参数也是.md文件路径，说明实际资源访问对象与声明不一致。虽然规则提取与部分行业标准文档分析相关，和声明中的第(3)项有明显重合，但整体描述的核心能力范围大于代码实际行为，且关键PDF相关能力缺失，因此构成描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Part of the description is accurate: the script does convert PDF text to Markdown and includes CJK spacing cleanup. It also has some industry-standard-specific handling through filename/URL pattern matching for standard IDs and categories. However, the more substantive claimed capabilities—'knowledge rule batch extraction' and broader structured knowledge extraction/analysis—are not present in this code. The script processes a single PDF input, extracts plain text per page, adds simple metadata, and outputs Markdown. That is a narrower behavior than the declared purpose, so this is a description-behavior mismatch.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python if rule not in rules[rtype]: rules[rtype].append(rule) return rules def rules_to_markdown(rules, title, standard_id): """将规则转为Markdown格式"""
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
All user-facing documentation in this file is presented only in Chinese, with no indication that the skill supports other languages or that Chinese-only usage is an intentional, justified regional constraint. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill advertises operations that imply shell execution, filesystem reads/writes, and network access, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this can cause the runtime to grant broader capabilities than users expect, increasing the chance of unintended file access, arbitrary downloads, or command execution through downstream scripts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description and title are written entirely in Chinese and present the skill as a Chinese/PDF knowledge extraction workflow, but they do not state that the skill is limited to Chinese-language users or provide any language-choice option. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest describes PDF text extraction, CJK spacing repair, rule extraction, and structured processing, but this script is specifically tied to harvesting URLs from a fixed external CDN path and orchestrating conversion by spawning another Python script. External source coupling and subprocess orchestration are implementation capabilities beyond the user-stated document-processing purpose in the manifest.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python fname = url.split('/')[-1] print(" Converting: %s ..." % fname[:50]) try: r = subprocess.run(cmd, capture_output=True, timeout=180) if r.returncode == 0: sz = os.path.getsize(out) // 1024 if os.path.exists(out) else 0 print(" [OK] %s_%s.md (%dKB)" % (seq, sid, sz))
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's user-facing messages are presented in Chinese, and elsewhere it emits Chinese report headings and Chinese default metadata values. Because this is a general-purpose extractor script and the file does not state that it is limited to a Chinese-only or region-specific workflow, the hard-coded locale behavior appears to enforce a specific language without user opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a PDF knowledge-extraction skill for processing PDF files, but this implementation accepts a URL and performs network retrieval with requests.get before processing. Network fetching is a broader behavior than local PDF extraction and is not mentioned in the manifest description.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This script can retrieve content from any URL beginning with 'http', which introduces a general network access capability. The manifest focuses on extracting text, fixing CJK spacing, and structuring industry-standard PDF documents; it does not state that the skill should browse or fetch remote resources.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The usage examples show the tool accepting HTTPS URLs as input, which implies outbound network requests to fetch remote PDF content. The README does not include any user-facing warning about network access, remote fetching, or associated privacy/integrity considerations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The file begins with a Chinese-only natural-language docstring describing the script. Under the policy rule for language/locale, forcing a specific language without offering user choice or documenting a justified locale restriction can be a policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script can make outbound network requests and write a generated Markdown file to disk without an explicit warning or confirmation, which may surprise users in agent-driven or automated contexts. While not a direct exploit primitive, this can cause unintended network access or overwrite an existing file path supplied on the command line, making the behavior risky in environments where side effects must be explicit.
- Content