ClawHub
Back to skill

Security audit

PDF Batch Processing Tool

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local PDF utility with ordinary file read/write behavior, but it overstates a couple of capabilities and uses unpinned Python dependencies.

Install this in an isolated environment and prefer pinned, reviewed dependency versions before processing untrusted PDFs. Expect merge, split, rotate, and text extraction to work; do not rely on image extraction or compression unless those scripts are added.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependencies Allow Unreviewed Package Versions

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-2 and SKILL.md:61-65
Vulnerability Type: Unpinned and unhashed third-party dependencies
Risk Level: Medium

Vulnerable Code

requirements.txt:1-2:

text
pypdf>=3.0.0
Pillow>=10.0.0

SKILL.md:61-65:

markdown
## Installation

```bash
pip install pypdf pillow
text

### Technical Analysis

The dependency declarations specify only minimum versions, while the documented installation command does not specify versions at all. Consequently, installation resolves whichever compatible package releases are available from the configured package index at that time. The project also provides no lockfile or cryptographic hashes with which to verify downloaded artifacts.

This makes builds non-reproducible and allows future, unreviewed versions of `pypdf` or `Pillow` to enter the execution environment automatically. If an upstream release, package-index account, configured mirror, or dependency artifact were compromised, installation could introduce attacker-controlled code without any change to this repository. Python packages may execute code during build or installation, and malicious code could also run when the installed modules are imported by the scripts.

No evidence was found that the currently named packages are typosquatted or malicious. The risk arises from unconstrained future resolution and missing artifact verification.

### Attack Path

1. An attacker compromises an upstream dependency release process, package-index account, distribution artifact, or package mirror used by the operator.
2. The attacker publishes a malicious release that satisfies `pypdf>=3.0.0` or `Pillow>=10.0.0`.
3. A user follows the installation instructions or installs `requirements.txt`.
4. `pip` resolves and downloads the malicious, unreviewed release because no exact version or artifact hash is enforced.
5. Attacker-controlled cod
...[truncated 726 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to an exact, reviewed version, for example:
    text
    pypdf==<reviewed-version>
Pillow==<reviewed-version>
  2. Generate and commit a lockfile that also fixes transitive dependency versions.
  3. Record approved artifact hashes and install with pip --require-hashes so substituted distributions are rejected.
  4. Update SKILL.md to instruct users to install from the reviewed requirements or lockfile rather than running unconstrained pip install pypdf pillow.
  5. Perform dependency updates through a controlled review process that includes vulnerability scanning, release-note review, automated tests, and deliberate lockfile regeneration.
  6. Use a trusted package index, restrict unapproved mirrors, and install into an isolated virtual environment under a non-privileged account.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description presents a broad batch PDF processing tool with several document-manipulation capabilities. However, the provided code implements only PDF text extraction. It reads PDFs with pypdf, extracts page text, and saves output as text files in single-file or batch mode. There is no code for merging PDFs, splitting PDFs, rotating pages, extracting images, or compressing PDFs. This is a material description-to-behavior mismatch because the declared primary purpose is substantially broader than the actual implemented functionality.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description presents a broad multi-function PDF batch processing skill, but the code chunk is narrowly focused on splitting a single PDF into multiple outputs. There is no implementation for merging, rotation, text extraction, image extraction, or compression. The code also does not demonstrate bulk processing across multiple input PDFs; it accepts a single --input PDF and writes split outputs. While splitting PDFs is accurately represented, the overall declared purpose materially overstates the implemented capabilities in this code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill advertises file-processing behavior and includes example commands that read and write local files, but it does not declare any explicit tool scope or permissions. In an agent setting, missing scope boundaries can cause the runtime or reviewer to underestimate the skill's filesystem access, increasing the risk of unintended access to sensitive local documents during bulk processing.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency specifier pypdf>=3.0.0 is unpinned, so builds may resolve to different versions over time, including versions with known security defects or behavior changes. In a PDF-processing skill that handles potentially untrusted documents, this increases supply-chain risk and makes it difficult to verify whether deployed versions are patched against parser denial-of-service issues.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
pypdf>=3.0.0
Pillow>=10.0.0

Unverifiable Dependency: pypdf has 16 known advisory(ies) (CVE-2026-84310 (pypdf: Possible long runtimes/large memory usage when retrieving outlines); CVE-2026-48156 (pypdf: Possible long runtimes for zero-only width values in cross-reference stre); CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

pypdf has multiple published advisories, and because the manifest does not pin a specific version, it is impossible to determine whether the installed version is affected. This is more concerning in this skill because PDF parsers operate on attacker-controlled inputs, and known pypdf issues include infinite loops and excessive memory or CPU consumption that could be triggered by crafted PDFs.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency specifier Pillow>=10.0.0 is unpinned, allowing installation of any newer release without review. Because Pillow processes complex file formats and has a history of memory-safety and resource-consumption issues, leaving it unpinned weakens reproducibility and can expose the skill to vulnerable or unexpected versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
pypdf>=3.0.0
Pillow>=10.0.0

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
89% confidence
Finding

Pillow has numerous known advisories, and the lack of version pinning prevents verification that deployments avoid vulnerable releases. Since this skill may extract images from PDFs and therefore process image data derived from untrusted files, any Pillow vulnerability affecting parsing, memory handling, or resource consumption becomes more relevant to the threat model.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.