ClawHub
Back to skill

Security audit

PDF-API.io

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent, but it tells agents that untagged actions are safe reads while leaving PDF generation untagged, which could create hosted PDFs without enough user confirmation.

Install only if you are comfortable using OOMOL’s oo CLI and connected PDF-API.io account. Treat render_pdf as an output-generating action: confirm the template, payload, and sensitivity of any data before running it, because it can produce a temporary hosted PDF URL.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest and description frame the skill as only for searching and reading, but the documented `render_pdf` action causes document generation and may trigger downstream processing or external side effects. This mismatch can mislead an agent into treating non-read operations as inherently safe, reducing scrutiny and user confirmation for actions that create artifacts or expose generated document URLs.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The safety section says untagged actions are reads, yet `render_pdf` is untagged even though it generates a new document and returns a hosted URL. That incorrect safety labeling can cause an agent to execute rendering without additional review, potentially creating and exposing sensitive documents under the assumption that the action is read-only.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger text is overly broad, directing the agent to use this skill for any PDF-API.io-related request without narrowing to safe, intended use cases. Broad routing language increases the chance the skill is invoked in contexts not covered by its safety assumptions, including operations involving sensitive templates, generated documents, or future connector actions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.