ClawHub

OkraPDF

Security checks across malware telemetry and agentic risk

Overview

OkraPDF is a coherent remote PDF-processing skill, but users should treat uploaded documents, prompts, and exports as data shared with an external service.

Install only if you trust OkraPDF with the PDFs and prompts you plan to process. Avoid uploading secrets, regulated records, customer data, or proprietary documents unless the provider and its retention policy are approved for that data. Use a dedicated API key, store it securely, review global npm package provenance, and require explicit confirmation before running delete, export, sandbox, or large parallel collection operations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (29)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill repeatedly instructs users and agents to upload PDFs and query extracted content through a third-party remote service, but it does not include any privacy, retention, sensitivity, or data-handling warning. In an agent context, that omission is risky because users may send confidential PDFs, regulated data, or internal documents off-platform without informed consent.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation includes delete operations for documents and collections without any warning about irreversibility, access checks, or confirmation guidance. In agent-driven workflows, destructive commands can be triggered automatically or by prompt confusion, leading to unintended data loss.

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP
```bash
# From URL
curl -X POST https://api.okrapdf.com/v1/documents \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://arxiv.org/pdf/2307.09288"}'
Confidence
89% confidence
Finding
curl -X POST https://api.okrapdf.com/v1/documents \ -H "Authorization: Bearer $OKRA_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "https://arxiv.org/pdf/2307.09288"}' # From file

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP
```bash
curl -X POST https://api.okrapdf.com/document/doc-abc123/chat/completions \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
86% confidence
Finding
curl -X POST https://api.okrapdf.com/document/doc-abc123/chat/completions \ -H "Authorization: Bearer $OKRA_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "messages": [{"role": "user

External Transmission

Medium
Category
Data Exfiltration
Content
**HTTP (fanout):**
```bash
curl -X POST https://api.okrapdf.com/v1/collections/col-xxx/query \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "What was total revenue in Q4?"}'
Confidence
88% confidence
Finding
curl -X POST https://api.okrapdf.com/v1/collections/col-xxx/query \ -H "Authorization: Bearer $OKRA_API_KEY" \ -H "Content-Type: application/json" \ -d '{"query": "What was total revenue in Q4?"

External Transmission

Medium
Category
Data Exfiltration
Content
# Fan-out: same question to multiple docs in parallel
for doc_id in doc-abc123 doc-def456 doc-ghi789; do
  curl -s -X POST "https://api.okrapdf.com/document/$doc_id/chat/completions" \
    -H "Authorization: Bearer $OKRA_API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"messages\": [{\"role\": \"user\", \"content\": \"What was total revenue?\"}], \"stream\": false}" &
Confidence
87% confidence
Finding
curl -s -X POST "https://api.okrapdf.com/document/$doc_id/chat/completions" \ -H "Authorization: Bearer $OKRA_API_KEY" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
"mcpServers": {
    "okra-pdf": {
      "type": "url",
      "url": "https://api.okrapdf.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
Confidence
82% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP
```bash
# From URL
curl -X POST https://api.okrapdf.com/v1/documents \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://arxiv.org/pdf/2307.09288"}'
Confidence
89% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"url": "https://arxiv.org/pdf/2307.09288"}'

# From file
curl -X POST https://api.okrapdf.com/v1/documents \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -F "file=@report.pdf" -F "page_images=cover"
```
Confidence
89% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP
```bash
# Full markdown
curl https://api.okrapdf.com/v1/documents/doc-abc123/full.md \
  -H "Authorization: Bearer $OKRA_API_KEY"

# Specific page
Confidence
84% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer $OKRA_API_KEY"

# Specific page
curl "https://api.okrapdf.com/v1/documents/doc-abc123/pages/3" \
  -H "Authorization: Bearer $OKRA_API_KEY"

# All pages as JSON
Confidence
80% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer $OKRA_API_KEY"

# All pages as JSON
curl https://api.okrapdf.com/v1/documents/doc-abc123/pages \
  -H "Authorization: Bearer $OKRA_API_KEY"
```
Confidence
82% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP (OpenAI-compatible)
```bash
curl -X POST https://api.okrapdf.com/document/doc-abc123/chat/completions \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
86% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP
```bash
curl -X POST https://api.okrapdf.com/document/doc-abc123/chat/completions \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
86% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP
```bash
curl https://api.okrapdf.com/v1/documents/doc-abc123/entities/tables \
  -H "Authorization: Bearer $OKRA_API_KEY"

curl https://api.okrapdf.com/v1/documents/doc-abc123/entities \
Confidence
78% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
curl https://api.okrapdf.com/v1/documents/doc-abc123/entities/tables \
  -H "Authorization: Bearer $OKRA_API_KEY"

curl https://api.okrapdf.com/v1/documents/doc-abc123/entities \
  -H "Authorization: Bearer $OKRA_API_KEY"
```
Confidence
78% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
**HTTP:**
```bash
# Create with seed documents
curl -X POST https://api.okrapdf.com/v1/collections \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Q4 Earnings", "document_ids": ["doc-abc123", "doc-def456"]}'
Confidence
76% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"name": "Q4 Earnings", "document_ids": ["doc-abc123", "doc-def456"]}'

# Add documents
curl -X POST https://api.okrapdf.com/v1/collections/col-xxx/documents \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"document_ids": ["doc-ghi789"]}'
Confidence
76% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
# List / get / delete
curl https://api.okrapdf.com/v1/collections -H "Authorization: Bearer $OKRA_API_KEY"
curl https://api.okrapdf.com/v1/collections/col-xxx -H "Authorization: Bearer $OKRA_API_KEY"
curl -X DELETE https://api.okrapdf.com/v1/collections/col-xxx -H "Authorization: Bearer $OKRA_API_KEY"
```

### Query across documents
Confidence
85% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
**HTTP (fanout):**
```bash
curl -X POST https://api.okrapdf.com/v1/collections/col-xxx/query \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "What was total revenue in Q4?"}'
Confidence
88% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
**HTTP (sandbox):**
```bash
curl -X POST https://api.okrapdf.com/v1/collections/col-xxx/query \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "Compare R&D spending. Show a table.", "mode": "sandbox"}'
Confidence
90% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### Export
```bash
# NDJSON stream
curl -N "https://api.okrapdf.com/v1/collections/col-xxx/export?format=markdown" \
  -H "Authorization: Bearer $OKRA_API_KEY"

# Zip archive
Confidence
79% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer $OKRA_API_KEY"

# Zip archive
curl -L "https://api.okrapdf.com/v1/collections/col-xxx/export?format=zip" \
  -H "Authorization: Bearer $OKRA_API_KEY" -o collection.zip
```
Confidence
80% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
okra extract report.pdf -o json -q > report.json

# HTTP
curl https://api.okrapdf.com/exports/doc-abc123/markdown -H "Authorization: Bearer $OKRA_API_KEY"
curl -o report.xlsx https://api.okrapdf.com/exports/doc-abc123/excel -H "Authorization: Bearer $OKRA_API_KEY"
curl -o report.docx https://api.okrapdf.com/exports/doc-abc123/docx -H "Authorization: Bearer $OKRA_API_KEY"
curl https://api.okrapdf.com/exports/doc-abc123/snapshot -H "Authorization: Bearer $OKRA_API_KEY"
Confidence
80% confidence
Finding
https://api.okrapdf.com/

External Transmission

Medium
Category
Data Exfiltration
Content
# HTTP
curl https://api.okrapdf.com/exports/doc-abc123/markdown -H "Authorization: Bearer $OKRA_API_KEY"
curl -o report.xlsx https://api.okrapdf.com/exports/doc-abc123/excel -H "Authorization: Bearer $OKRA_API_KEY"
curl -o report.docx https://api.okrapdf.com/exports/doc-abc123/docx -H "Authorization: Bearer $OKRA_API_KEY"
curl https://api.okrapdf.com/exports/doc-abc123/snapshot -H "Authorization: Bearer $OKRA_API_KEY"
```
Confidence
79% confidence
Finding
https://api.okrapdf.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal