ClawHub
Back to skill

Security audit

Lock PDF

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward PDF-locking API integration, but it sends sensitive PDFs and passwords to a third party and offers weak legacy RC4 encryption without enough warning.

Review this before installing if you handle private, regulated, or high-value PDFs. Use only if pdfapihub.com is an approved processor for your documents and passwords, prefer AES-256, avoid RC4, and avoid sending sensitive files unless you understand the provider's retention and access controls.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
skill.json:15
Finding

Obsolete RC4 Encryption Is Offered for PDF Protection

Content
View full analysis

Vulnerability Details

File Location: skill.json:15 and SKILL.md:8
Vulnerability Type: Use of an obsolete cryptographic algorithm
Risk Level: Medium

Affected code snippets:

skill.json:15

json
{ "name": "encryption", "type": "string", "required": false, "default": "aes256", "enum": ["aes256", "aes128", "rc4"], "description": "Encryption algorithm" },

SKILL.md:8

markdown
Encrypts a PDF with password protection. Supports AES-256 (default), AES-128, and RC4-128 encryption. Allows setting separate user and owner passwords with granular permission controls.

Technical Analysis

The skill explicitly permits users to select RC4 for PDF encryption. RC4 is a deprecated stream cipher with known cryptographic weaknesses and is not appropriate for protecting confidential documents. Although AES-256 is the default, the accepted rc4 configuration allows callers to produce documents with materially weaker protection.

The weakness does not grant local system privileges or provide direct code execution. Exploitation requires access to a PDF that was protected using the RC4 option. The practical severity also depends on the PDF encryption revision, password strength, and the attacker's access to the encrypted file.

Attack Path

  1. A user or integrating application explicitly sets the encryption field to rc4.
  2. The external PDF service generates a document using obsolete RC4-based protection.
  3. The resulting encrypted PDF is distributed, stored, intercepted, or otherwise obtained by an attacker.
  4. The attacker identifies the PDF encryption configuration and applies password-recovery or cryptanalytic tooling targeting legacy PDF and RC4 protection.
  5. If the protection is defeated, the attacker can access the PDF contents despite the user's expectation of strong encryption.

Impact Assessment

Successful exploitation can compromise the confidentiality of the affected PDF ...[truncated 295 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove rc4 from the accepted encryption enumeration in skill.json.
  2. Remove all documentation that advertises RC4 support.
  3. Retain AES-256 as the default and preferred algorithm.
  4. Permit AES-128 only when legacy compatibility is necessary and clearly document that limitation.
  5. Enforce the algorithm allowlist on the server side rather than relying only on client metadata.
  6. Reject requests specifying rc4 with a clear validation error.
  7. Add automated tests confirming that obsolete algorithms cannot be selected.
  8. Review previously generated RC4-protected documents and re-encrypt sensitive files using AES-256 with strong, unique passwords.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to send PDFs and the opening password to an external third-party API, but the description does not clearly warn that both document contents and secrets will leave the local environment. This can lead to inadvertent disclosure of sensitive documents or credentials, especially because the use cases explicitly include confidential, financial, and compliance-related materials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The example usage shows direct transmission of a PDF URL and encryption passwords to an external service endpoint. While this is core to the skill's functionality, it is still a security-relevant data exfiltration path because sensitive document references and secrets are sent off-platform to a third party.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

Example Usage

bash
curl -X POST https://pdfapihub.com/api/v1/lockPdf \
  -H "CLIENT-API-KEY: your_api_key" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This skill sends highly sensitive document content, passwords, and possibly existing decryption passwords to an external third-party API, but the manifest does not clearly warn users about that data transfer. In practice, users may provide confidential PDFs believing processing is local or first-party, creating a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This JSON manifest contains only request/response data and provides no natural-language description of when the skill should be invoked or what phrases should activate it. For manifest files, the absence of any trigger constraints can make invocation scope ambiguous if this file is used as part of a skill definition.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This is a manifest file, so vague-trigger checks apply. The manifest provides only a general name and description for the skill and does not specify when it should or should not be invoked, explicit trigger phrases, or exclusion conditions, which can make activation boundaries ambiguous in systems that derive invocation behavior from manifest metadata.

Content

No source excerpt is available for this finding.