ClawHub
Back to skill

Security audit

Bohrium PDF Parser

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Bohrium PDF parsing guide that sends user-selected PDFs or PDF URLs to Bohrium as its stated purpose.

Install only if you are comfortable sending selected PDFs or PDF URLs to Bohrium for processing. Do not use confidential, regulated, internal, signed, or private documents unless that external processing is approved, and avoid exposing ACCESS_KEY values or result tokens in logs, prompts, commits, or shared shell history.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly sends user-provided PDF URLs and uploaded PDF files to the external domain open.bohrium.com, but the description does not clearly warn users that document contents and metadata leave the local environment. This can cause inadvertent disclosure of sensitive documents, especially because users may assume a parser skill operates locally unless told otherwise.

External Transmission

Medium
Category
Data Exfiltration
Content
## URL Submission

```python
r = requests.post(f"{BASE}/trigger-url-async", headers=HEADERS_JSON, json={
    "url": "https://arxiv.org/pdf/2107.06922",
    "sync": False,
    "textual": True,
Confidence
97% confidence
Finding
This code submits a user-supplied PDF URL and parse options to an external service, which is a genuine data egress path. In the context of document parsing, this behavior is expected, but it is still security-relevant because referenced documents and potentially sensitive research content are transmitted off-platform.

External Transmission

Medium
Category
Data Exfiltration
Content
## Query Parse Result

```python
r = requests.post(f"{BASE}/get-result", headers=HEADERS_JSON, json={
    "token": token,
    "content": True,        # Return extracted text
    "objects": False,        # Return extracted objects (tables, figures, etc.)
Confidence
92% confidence
Finding
The get-result call retrieves parsed content from the external service using a token, confirming that extracted document text is stored and fetched from a third-party system. This extends the external exposure beyond submission and may include sensitive extracted text and metadata.

External Transmission

Medium
Category
Data Exfiltration
Content
HEADERS_JSON = {**HEADERS, "Content-Type": "application/json"}

# 1. Submit
r = requests.post(f"{BASE}/trigger-url-async", headers=HEADERS_JSON, json={
    "url": "https://arxiv.org/pdf/2107.06922",
    "sync": False,
    "textual": True, "table": True, "molecule": False,
Confidence
97% confidence
Finding
The async polling example again demonstrates outbound submission of document URLs to the Bohrium API. Although aligned with the skill's purpose, it remains a real external-transmission risk because the skill handles potentially sensitive PDFs and could be used on documents users did not intend to share externally.

External Transmission

Medium
Category
Data Exfiltration
Content
# 2. Poll for result
for attempt in range(30):
    time.sleep(2)
    r = requests.post(f"{BASE}/get-result", headers=HEADERS_JSON, json={
        "token": token,
        "content": True,
        "objects": False,
Confidence
91% confidence
Finding
Polling get-result sends the task token to the external service and retrieves document-derived content, creating an additional egress and exposure surface. If tokens are logged or shared, unauthorized parties may be able to fetch parse results depending on server-side controls.

External Transmission

Medium
Category
Data Exfiltration
Content
```python
# 1. Synchronous submit — blocks until parsing completes
r = requests.post(f"{BASE}/trigger-url-async", headers=HEADERS_JSON, json={
    "url": "https://arxiv.org/pdf/2107.06922",
    "sync": True,           # Wait for completion
    "textual": True, "table": True,
Confidence
96% confidence
Finding
The synchronous example still transmits the PDF URL and options to the external Bohrium endpoint, so the same confidentiality concerns apply. The blocking behavior may make users think processing is local or self-contained when it is still third-party processing.

External Transmission

Medium
Category
Data Exfiltration
Content
# submit["status"] == "success", but no content field

# 2. Retrieve content
r = requests.post(f"{BASE}/get-result", headers=HEADERS_JSON, json={
    "token": token,
    "content": True, "objects": False, "pages_dict": False
})
Confidence
90% confidence
Finding
Retrieving parsed content after synchronous submission confirms the service returns extracted document text from a remote processor. This is expected behavior for the integration, but it is still security-sensitive because content may contain proprietary or regulated information.

External Transmission

Medium
Category
Data Exfiltration
Content
---

## curl Examples

```bash
AK="YOUR_ACCESS_KEY"
Confidence
94% confidence
Finding
The curl examples operationalize direct transmission of access keys, PDF files, document URLs, and result tokens to the external API. This is a true security-relevant behavior because users may copy-paste these commands into shells with history, logs, or shared environments, increasing accidental exposure.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The authentication section documents use of an access key and shows it stored in configuration, but does not warn against logging, exposing, or hardcoding secrets. While it does not directly leak a real credential, the omission increases the chance of unsafe credential handling in downstream use and examples.

Static analysis

No suspicious patterns detected.