ClawHub
Back to skill

Security audit

Pdf Anthropic

Security checks for vulnerabilities and agentic risk

Overview

This is a PDF-processing helper skill with local scripts and examples that match its stated purpose, though users should be careful with file overwrites, decrypted copies, and unpinned OCR installs.

Install only if you want a broad local PDF utility skill. Run examples on copies of important PDFs, be cautious with password removal and decrypted outputs, avoid in-place repair unless you have a backup, and use a virtual environment with pinned dependencies for OCR workflows.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:235
Finding

Unpinned Third-Party OCR Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:235
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

python
# Requires: pip install pytesseract pdf2image

Technical Analysis

The OCR example instructs users to install pytesseract and pdf2image without version constraints, package hashes, a lockfile, or an explicitly trusted package index. Dependency resolution therefore retrieves mutable artifacts from the user's configured Python package source.

This is a supply-chain weakness rather than evidence that the named packages are malicious. If a dependency release or configured package source is compromised, following the instruction could install attacker-controlled code. Such code may execute during package installation or when the installed module is imported by the OCR workflow.

Attack Path

  1. An attacker compromises a relevant package release, its dependency chain, or a package index trusted by the user's environment.
  2. A user follows the OCR prerequisite in SKILL.md.
  3. The user runs pip install pytesseract pdf2image without version or hash verification.
  4. pip resolves and downloads mutable artifacts from the configured index.
  5. Malicious package code executes during installation or subsequent import.
  6. The code runs with the privileges of the user performing the installation or PDF-processing task.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. The resulting access could include reading or modifying files available to that account, tampering with processed PDFs, accessing documents supplied to the workflow, and using the user's network permissions.

The project does not request elevated privileges, and the reviewed code contains no privilege-escalation mechanism. Consequently, the direct impact is limited to the privileges and environment of the user running pip.

Remediation
View remediation

Remediation Suggestions

  • Replace the inline installation instruction with a reviewed and version-controlled dependency manifest.
  • Pin exact versions for direct and transitive dependencies.
  • Generate and verify cryptographic hashes, then install with:
    bash
    python -m pip install --require-hashes -r requirements.txt
  • Use an explicitly approved package index or internal artifact repository.
  • Regularly scan pinned dependencies for known vulnerabilities and review updates before changing the lockfile.
  • Install dependencies inside an isolated virtual environment or container using a non-privileged account.
  • Document the expected package names and sources to reduce dependency-confusion and index-substitution risks.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description promises a broad PDF-processing skill covering many common PDF operations. The supplied code does something materially different: it loads a JSON structure containing form_fields, checks for intersecting label/entry bounding boxes on the same page, verifies entry box height against font size, and emits success/failure messages. This is a specialized validation utility for form-field geometry metadata, not a general PDF skill. There is no code handling PDFs themselves or any of the listed capabilities, so the description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description presents this as a comprehensive PDF skill covering many common PDF operations. The supplied code chunk does something much narrower and materially different: it rasterizes PDF pages into PNG images. While this is loosely PDF-related, the specific capability of converting pages to images is not clearly included in the description (which mentions extracting images from PDFs, typically meaning embedded image extraction, not rendering pages as images). Because the actual code's primary purpose is narrower and different from the declared broad PDF-tool behavior, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description promises broad PDF-file operations, but this code does not read, write, parse, transform, or OCR PDFs. Instead, it consumes a JSON description of form fields plus an image, draws bounding boxes for matching page fields, and outputs an annotated image. That is a materially different primary purpose and resource profile from the declared PDF skill, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This code is narrowly focused on inspecting interactive PDF form annotations using pypdf and exporting metadata about fields to a JSON file. It does not perform the wide range of PDF operations promised by the description. While form-related handling is adjacent to the declared 'filling PDF forms' use case, the actual behavior here is specifically extracting field information rather than filling forms or providing general PDF manipulation. That makes the declared description materially broader than the code’s actual purpose, so this is a mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The activation text says to use the skill whenever the user wants 'anything with PDF files' or merely mentions a .pdf file, which is overly broad. That can cause accidental invocation in unrelated contexts, expanding the chance that the agent reads, transforms, decrypts, or writes files when the user did not intend to trigger a PDF-processing workflow.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guide includes a direct example for decrypting password-protected PDFs and producing a decrypted output file without any caution, authorization check, or handling guidance. In an agent setting, that normalization can encourage bypassing document protections or leaving sensitive decrypted copies on disk, increasing data exposure risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest describes a PDF skill for reading, extracting, filling, and transforming PDFs, but these instructions additionally direct use of external shell commands via ImageMagick (magick/convert) for manual image cropping. Spawning arbitrary external tooling is not an obvious or necessary capability implied by the skill description, especially when presented as part of the operational workflow rather than an internal implementation detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The example uses qpdf --replace-input corrupted.pdf, which overwrites the original file in place. In an agent skill context, this is dangerous because users or downstream agents may copy the command verbatim and unintentionally destroy the only copy of a PDF if the repair operation fails, partially succeeds, or produces undesired changes. The PDF-processing context increases risk because file modification is a core task and users are likely to run examples directly on important documents.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest describes a skill for operating on PDF files, but this script operates on raster images by opening an input image, drawing rectangles, and saving an output image. While such imagery may be related to PDF processing pipelines, this file's actual behavior is image validation/annotation rather than direct PDF reading, editing, OCR, or form filling as described.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script advertises filling PDF form fields, but it actually overlays user-supplied text as FreeText annotations. This can break workflows that expect true AcroForm field population, cause data to be non-editable/non-exportable, and create integrity issues where a document appears completed visually while underlying form fields remain blank.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script saves an image to the user-supplied output path, which is a file-write operation covered by the warning requirement for code files. While it prints a success message after saving, there is no prior confirmation, warning comment, or docstring disclosing that the command will create or overwrite a file at the specified path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code performs a file write of the filled PDF to the user-supplied output path, but there is no confirmation prompt and no comment or docstring warning that the script will create or overwrite a file. For code files, file writes can warrant a disclosure unless the action is clearly communicated; here only a bare usage line is shown, not a warning about the write behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.