ClawHub
Back to skill

Security audit

Merge PDFs

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward hosted PDF-merge skill; the main risk is that documents and metadata are sent to pdfapihub.com when used.

Install this only if you are comfortable sending PDFs, PDF URLs, optional metadata, and your pdfapihub.com API key to that external service. Avoid using it for confidential, regulated, or internal-only documents unless your organization has approved the provider and its data-handling terms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill encourages users to submit PDFs, URLs, and metadata to an external service but does not clearly disclose that potentially sensitive documents will leave the local/agent environment and be processed by a third party. In this context, the use cases include invoices, legal documents, student submissions, and mortgage packages, which commonly contain confidential or regulated data, so omission of a clear data-sharing warning materially increases privacy and compliance risk.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill sends user-supplied PDFs, base64 document contents, or remote PDF URLs to an external third-party service, but the description does not clearly disclose that off-platform data transfer occurs. This can lead users or downstream agents to share sensitive documents without informed consent, creating privacy, confidentiality, and compliance risk.

Static analysis

No suspicious patterns detected.