ClawHub
Back to skill

Security audit

Pdf2md Universal

Security checks across malware telemetry and agentic risk

Overview

This PDF-to-Markdown skill is mostly coherent, but scanned-PDF OCR can automatically use an external vision adapter without a clear user consent step for sensitive documents.

Install only if you are comfortable with the OCR behavior. Use --ocr none or a local OCR tool for confidential PDFs, and only point BAILIAN_ADAPTER or --bailian-adapter at Python code you fully trust. Treat remote OCR as document upload unless the adapter proves otherwise.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Content
except ImportError:
        try:
            mod_name = os.path.splitext(os.path.basename(adapter))[0]
            mod = __import__(mod_name)
            vision_describe = mod.vision_describe
        except Exception:
            return None
Confidence
97% confidence
Finding
mod = __import__(mod_name)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README instructs users to run OCR through a configurable model adapter but does not disclose that scanned PDF contents may be sent to an external service or processed outside the local environment. In an agent context, this omission can cause sensitive documents to be transmitted without informed consent, creating privacy, confidentiality, and compliance risks.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger list is very broad and covers common PDF-related requests such as converting PDFs, reducing token usage, or extracting scanned text, without clear boundaries on when the skill should or should not activate. This can cause the skill to run in contexts the user did not intend, increasing the chance of unsolicited file processing or prompting users toward local/external document conversion flows.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly supports OCR through external tools or services, including a Bailian adapter, but does not clearly warn users that PDF contents may be transmitted to or processed by third-party OCR components. If sensitive PDFs are handled under this flow, users may unknowingly expose confidential financial, legal, research, or personal data to external systems.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The OCR path explicitly renders PDF pages to images and sends them to vision_describe, which is described as using 百炼 qwen3-vl-plus. This can disclose sensitive document contents to an external service without a clear user-facing consent prompt or warning at runtime, which is particularly risky for private or regulated PDFs.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.