Pdf Extract

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:25 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent PDF-extraction purpose, but it tells agents to run an unbundled local extractor from a mutable OpenClaw workspace path without install or integrity checks.

Review this skill before installing unless you control and trust ~/.openclaw/workspace/pdf-tools. Prefer a version that bundles the extractor or verifies the script, virtualenv, and dependencies before execution.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:32

Finding

Execution of an Unverified Tool from a Mutable External Path

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-44
Vulnerability Type: Unverified external tool execution
Risk Level: Medium

bash

cd ~/.openclaw/workspace/pdf-tools
source bin/activate 2>/dev/null || true

# Extract all text (pdfplumber - best for tables/structure)
./pdf_extract.py /path/to/file.pdf

# Extract specific pages
./pdf_extract.py /path/to/file.pdf --pages 1,3-5

# Fast extraction (PyMuPDF - best for speed/simple text)
./pdf_extract.py /path/to/file.pdf --method pymupdf

# Combine: fast extract of specific pages
./pdf_extract.py /path/to/file.pdf --method pymupdf --pages 1-10

Technical Analysis

The skill instructs the agent to change into ~/.openclaw/workspace/pdf-tools, activate that directory's virtual environment, and execute pdf_extract.py. Neither the script, the activation script, nor a dependency manifest is included in the audited project. Consequently, the implementation and provenance of the invoked components cannot be verified as part of this audit.

The referenced directory is external to the skill package and may be mutable by the local user or another process operating with equivalent permissions. If an attacker can replace pdf_extract.py, bin/activate, or imported Python dependencies, subsequent legitimate-looking PDF extraction requests can execute attacker-controlled code.

The command source bin/activate 2>/dev/null || true suppresses activation failures and continues execution. This fail-open behavior may cause the extractor to run under an unintended interpreter or dependency environment, further weakening execution predictability.

Attack Path

1. An attacker obtains write access to ~/.openclaw/workspace/pdf-tools or a component loaded from its virtual environment.
2. The attacker replaces pdf_extract.py, modifies bin/activate, or substitutes an imported dependency with malicious code.
3. A user asks the agent to extract, read ...[truncated 934 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle pdf_extract.py and its required support files inside the skill package so they are covered by review and version control.
2. Resolve the executable relative to the installed skill directory rather than relying on the mutable ~/.openclaw/workspace/pdf-tools path.
3. Pin dependency names and versions with cryptographic hashes using a lock file or hash-verified installation process.
4. Before execution, validate the ownership, permissions, expected path, and cryptographic digest of the extractor and environment files.
5. Do not source an unverified activation script. Invoke a known interpreter directly through an absolute, validated path.
6. Remove 2>/dev/null || true and fail closed if the required environment cannot be activated or validated.
7. Run PDF processing with least privilege in a sandbox that restricts filesystem access, network access, subprocess creation, and resource consumption.
8. Treat PDFs as untrusted input and keep the parsing libraries patched, because malformed documents may target vulnerabilities in PDF parsers.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s invocation guidance includes broad phrases such as generic PDF analysis requests and an explicit catch-all condition for 'Any task involving local PDF file analysis.' This can cause the agent to activate the skill in situations where a narrower or safer tool selection policy would be more appropriate, increasing the chance of unintended execution paths or overuse of this skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.