Back to skill

Security audit

Bohrium PDF Parser

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Bohrium PDF parsing helper, but it sends PDFs or PDF links to Bohrium's external service.

Install only if you are comfortable sending PDF URLs, uploaded PDF files, task tokens, and parsed results through open.bohrium.com using a Bohrium access key. Do not use it for confidential, proprietary, client, secret, or regulated documents unless Bohrium is approved for that data and you understand its retention and privacy terms.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly supports uploading local PDFs and submitting PDF URLs to a third-party service, but it does not prominently warn users that document contents and referenced URLs are transmitted off-platform to open.bohrium.com. This creates a real privacy and data-handling risk, especially if users provide sensitive, proprietary, or regulated documents under the assumption processing is local.

External Transmission

Medium
Category
Data Exfiltration
Content
## URL Submission

```python
r = requests.post(f"{BASE}/trigger-url-async", headers=HEADERS_JSON, json={
    "url": "https://arxiv.org/pdf/2107.06922",
    "sync": False,
    "textual": True,
Confidence
92% confidence
Finding
requests.post(f"{BASE}/trigger-url-async", headers=HEADERS_JSON, json=

External Transmission

Medium
Category
Data Exfiltration
Content
## Query Parse Result

```python
r = requests.post(f"{BASE}/get-result", headers=HEADERS_JSON, json={
    "token": token,
    "content": True,        # Return extracted text
    "objects": False,        # Return extracted objects (tables, figures, etc.)
Confidence
88% confidence
Finding
requests.post(f"{BASE}/get-result", headers=HEADERS_JSON, json=

External Transmission

Medium
Category
Data Exfiltration
Content
HEADERS_JSON = {**HEADERS, "Content-Type": "application/json"}

# 1. Submit
r = requests.post(f"{BASE}/trigger-url-async", headers=HEADERS_JSON, json={
    "url": "https://arxiv.org/pdf/2107.06922",
    "sync": False,
    "textual": True, "table": True, "molecule": False,
Confidence
92% confidence
Finding
requests.post(f"{BASE}/trigger-url-async", headers=HEADERS_JSON, json=

External Transmission

Medium
Category
Data Exfiltration
Content
# 2. Poll for result
for attempt in range(30):
    time.sleep(2)
    r = requests.post(f"{BASE}/get-result", headers=HEADERS_JSON, json={
        "token": token,
        "content": True,
        "objects": False,
Confidence
87% confidence
Finding
requests.post(f"{BASE}/get-result", headers=HEADERS_JSON, json=

External Transmission

Medium
Category
Data Exfiltration
Content
```python
# 1. Synchronous submit — blocks until parsing completes
r = requests.post(f"{BASE}/trigger-url-async", headers=HEADERS_JSON, json={
    "url": "https://arxiv.org/pdf/2107.06922",
    "sync": True,           # Wait for completion
    "textual": True, "table": True,
Confidence
90% confidence
Finding
requests.post(f"{BASE}/trigger-url-async", headers=HEADERS_JSON, json=

External Transmission

Medium
Category
Data Exfiltration
Content
# submit["status"] == "success", but no content field

# 2. Retrieve content
r = requests.post(f"{BASE}/get-result", headers=HEADERS_JSON, json={
    "token": token,
    "content": True, "objects": False, "pages_dict": False
})
Confidence
87% confidence
Finding
requests.post(f"{BASE}/get-result", headers=HEADERS_JSON, json=

External Transmission

Medium
Category
Data Exfiltration
Content
---

## curl Examples

```bash
AK="YOUR_ACCESS_KEY"
Confidence
85% confidence
Finding
curl Examples ```bash AK="YOUR_ACCESS_KEY" BASE="https://open.bohrium.com/openapi/v1/parse" # URL submission curl -s -X POST "$BASE/trigger-url-async" \ -H "Content-Type: application/json" \ -H

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.