ClawHub
Back to skill

Security audit

pdfly-cli

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent PDF tool reference, but its signing instructions include risky handling of certificate passwords and private keys.

Review the signing section before installing or using this skill. Prefer writing signed PDFs to a new output file, keep backups, avoid putting real certificate passwords directly in commands or chats, and do not use unencrypted private-key export unless you understand and control where that key file is stored.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation promotes `--in-place` signing but does not explicitly warn that the original PDF will be overwritten. This can cause irreversible data loss or corruption if the signing operation fails, is misapplied, or is used on the wrong file.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The example shows the PKCS12 password directly on the command line, which can expose secrets via shell history, process listings, logs, or terminal recordings. In a signing workflow, this credential protects private-key material, so disclosure can enable unauthorized signing or key compromise.

Missing User Warnings

High
Confidence
99% confidence
Finding
The OpenSSL example uses `-nodes`, which outputs private key material without encryption, but the documentation gives no warning about the sensitivity of the resulting file. This materially increases the chance that users leave an unencrypted private key on disk, allowing theft of signing credentials and fraudulent document signing.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.