ClawHub
Back to skill

Security audit

pdf2img

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward, user-invoked PDF-to-image converter with some resource-use and dependency-hardening caveats.

Install and run this only in a normal isolated Python environment, avoid untrusted or extremely large PDFs, keep scale values conservative, and prefer pinned dependency versions if reproducibility matters.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/pdf_to_long_image.py:53
Finding

Unbounded PDF Rendering Can Exhaust Memory, CPU, and Disk Resources

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:45
Finding

Third-Party Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md
description: |
  Convert multi-page PDFs into a single vertical long image by concatenating all pages.
  Use when the user asks to convert PDF to long image, combine PDF pages into one image,
  or create a scrolling screenshot from a PDF document.
---

# PDF to Long Image

Static analysis

No suspicious patterns detected.