ClawHub
Back to skill

Security audit

PDF to markdown converter

Security checks for vulnerabilities and agentic risk

Overview

The skill is for document conversion, but it relies on unpinned npm/npx execution, can install skills across agents, and does not clearly scope remote document processing and credential handling.

Review this before installing if you handle private documents. Prefer a pinned, vetted CLI version, avoid npx execution of floating packages, confirm where documents are sent before parsing sensitive files, and store API keys through safer login or secret-management flows rather than inline shell commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
rules/install.md:14
Finding

Unpinned Third-Party npm Package Is Downloaded and Executed Automatically

Content
View full analysis

Vulnerability Details

File Location: rules/install.md:14-17, rules/install.md:21-32, rules/install.md:97-101, rules/security.md:19-23, and SKILL.md:7-10
Vulnerability Type: Unpinned dependency execution and software supply-chain exposure
Risk Level: Medium

Vulnerable Code

rules/install.md:14-17:

bash
## Quick setup

```bash
npx -y pdf2markdown-cli init -y
text

`rules/install.md:21-32`:

```bash
## Manual install

Choose by package manager:

```bash
# npm (default)
npm install -g pdf2markdown-cli

# pnpm
pnpm add -g pdf2markdown-cli

# yarn
yarn global add pdf2markdown-cli
text

`rules/install.md:97-101`:

```bash
1. Check npm global bin is in PATH: `npm bin -g`
2. Use npx: `npx pdf2markdown-cli --version`
3. Reinstall: `npm install -g pdf2markdown-cli`

rules/security.md:19-23:

bash
# Installation

```bash
npm install -g pdf2markdown-cli
text

`SKILL.md:7-10`:

```yaml
allowed-tools:
  - Bash(pdf2markdown *)
  - Bash(pdf2md *)
  - Bash(npx pdf2markdown *)
  - Bash(npx pdf2md *)

Technical Analysis

The installation instructions execute pdf2markdown-cli without pinning an exact reviewed version or verifying package integrity. In particular, npx -y pdf2markdown-cli init -y can retrieve the package version currently resolved by the npm registry and execute its lifecycle and initialization code without an interactive confirmation step.

The documented initialization operation has broader effects than a one-time document conversion because it installs skills and configures authentication. The global installation alternatives similarly place an unpinned third-party executable in the user's command search path. Subsequent commands permitted by SKILL.md can then invoke that installed executable.

No evidence was found that the referenced package is currently malicious. The vulnerability is the unsafe tru ...[truncated 1950 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to an exact reviewed version in every installation and execution example, such as pdf2markdown-cli@X.Y.Z; do not use floating tags or version ranges.
  2. Commit a lockfile where the deployment model permits it and validate npm integrity metadata before execution.
  3. Replace automatic npx -y setup with a reviewable installation process that requires explicit user confirmation before downloading code, configuring authentication, or installing additional skills.
  4. Separate CLI installation, authentication, and agent-skill installation into distinct opt-in steps. Clearly disclose the files and directories modified by each step.
  5. Run the package with the minimum necessary privileges. Do not recommend administrator or root execution for global installation.
  6. Prefer a locally installed, locked dependency invoked through a package script over an unpinned global executable.
  7. Review and pin transitive dependencies, monitor package ownership and release changes, and use automated dependency scanning or provenance verification where available.
  8. Restrict allowed command patterns to the pinned and reviewed invocation. Avoid broad npx allowances that can retrieve mutable code at runtime.
  9. Document package checksums, supported trusted versions, and a controlled upgrade procedure requiring security review before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The manifest includes npx pdf2md without an exact version, creating the same supply-chain exposure as other unpinned npx entries. In a security-sensitive automation context, mutable package resolution should be treated as unsafe by default.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The manifest includes npx pdf2md without an exact version, creating the same supply-chain exposure as other unpinned npx entries. In a security-sensitive automation context, mutable package resolution should be treated as unsafe by default.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases are broad enough to activate on generic requests like document parsing or text extraction, which can cause the agent to invoke a remote-processing skill when the user did not clearly consent to that path. In this skill, unintended activation matters more because documents may be sensitive and the tool can process local files or URLs using an authenticated external service.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill permits execution via npx pdf2markdown * without pinning a specific package version, so each invocation may fetch or resolve updated code from the registry. That creates a supply-chain risk where a compromised upstream package, typo-squatted dependency, or unexpected major update could execute arbitrary code in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The allowed tool npx pdf2md * is unpinned, which means the executed package is not fixed to a known-good version. In an agent setting, this increases the chance of arbitrary code execution through package compromise or unexpected behavior changes during normal skill use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill does not clearly warn that document content may be uploaded to a remote authenticated service, which creates a data exposure and consent risk. Because the skill handles PDFs and images that may contain sensitive information, lack of explicit disclosure can lead to unintentional transmission of confidential data outside the local environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Using npx -y pdf2markdown-cli init -y without pinning an explicit package version allows execution of whatever version is currently published to the npm registry at install time. If the package is compromised, a malicious version is published, or a dependency supply-chain attack occurs, users could execute unreviewed code during setup and authentication.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The verification command npx pdf2markdown-cli --version is also unpinned, so it may fetch and execute the latest registry version rather than the version the user intended to validate. Even though this appears to be a harmless version check, npx can still install and run package code, making it a supply-chain execution risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The authentication examples place API keys directly on the command line and in shell assignment examples without warning about shell history, process-list exposure, or secure secret storage. Users may inadvertently leak live credentials through terminal history, screen recordings, shared logs, or environment inspection, which is especially sensitive because the skill requires authenticated CLI use.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The fallback advice to use npx pdf2markdown-cli --version repeats the same unpinned remote execution pattern. In an installation guide, this increases risk because users are explicitly encouraged to run ad hoc package code during troubleshooting, often with less scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The reinstall instruction npm install -g pdf2markdown-cli does not pin a version, so users will receive whatever release is current at execution time. This creates a mutable installation path that can silently introduce vulnerable or malicious code if the package or publisher is compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.