ClawHub
Back to skill

Security audit

pdf2jpg

Security checks for vulnerabilities and agentic risk

Overview

This skill performs a narrow local PDF-to-JPEG conversion workflow with optional zipping, with no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Install only if you are comfortable installing poppler-utils on your system and running local scripts on PDFs you choose. Expect JPEG files to be written beside the source PDF and optional zip archives to be created; non-Chinese users may find the script prompts and error messages unclear.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The implemented behavior matches the PDF-to-JPEG conversion portion of the description, including optional page range support and the pdftoppm dependency. However, the description also claims the skill bundles the generated JPGs into a zip archive for sharing, and there is no code that invokes zip or otherwise archives the output files. This is a material description-to-behavior mismatch because a stated user-facing capability is absent from the code.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a tool whose main function is converting PDFs into JPEG images, with optional page selection, then packaging results into a zip. The supplied script only searches for already-existing JPEG files named after the PDF basename and compresses them with zip. It never invokes pdftoppm, never renders pages from the PDF, and provides no page-range support. While zipping JPGs is part of the declared behavior, the primary advertised capability—PDF conversion—is absent, so this is a material description/behavior mismatch.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

  • Debian / Ubuntu:
    bash
    sudo apt update
sudo apt install -y poppler-utils

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

  • Debian / Ubuntu:
    bash
    sudo apt update
sudo apt install -y poppler-utils

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

User-visible strings such as the prompt and error messages are hard-coded in Chinese, which creates a language/locale policy concern when no opt-in, fallback, or justification is provided. The policy specifically calls for flagging skills that force a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's interactive prompt and error messages are written only in Chinese (for example at L08, L12, and L24). This imposes a specific language on users without opt-in or justification, which matches the natural-language locale policy violation category.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes a PDF-to-JPEG conversion capability using pdftoppm, but this file merely searches for preexisting files matching ${base}-*.jpg and archives them with zip. There is no invocation of pdftoppm or any image-generation logic here, so the implemented behavior is narrower than the advertised conversion workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This code file invokes an external subprocess via pdftoppm to convert the provided PDF, but the script does not disclose that it will execute a system command beyond dependency checks. Under the code-file criteria, subprocess execution should have some visible user disclosure unless it is clearly documented as the skill's stated purpose, which is not present in this file itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.