ClawHub
Back to skill

Security audit

OkraPDF

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent OkraPDF integration for uploading and querying PDFs through a remote service, with no hidden execution or deception found.

Install this only if you are comfortable sending selected PDFs, document text, questions, and extracted outputs to OkraPDF. Avoid confidential, regulated, or proprietary documents unless your organization approves that service, and prefer a pinned or project-local CLI install plus a limited API key.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Global npm Package Installation Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:32
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Complete Code Snippet:

bash
npm install -g okrapdf

Technical Analysis

The setup instructions install the mutable latest release of the third-party okrapdf npm package without a pinned version, lockfile, integrity hash, or provenance verification. Because the package is installed globally, npm may execute package lifecycle scripts with the privileges of the invoking user and place executable commands in a globally accessible location.

The audited project contains only documentation and does not include the package source or dependency metadata needed to verify the code ultimately fetched from the npm registry. Consequently, the effective installed payload can change after this Skill has been reviewed.

This is an insecure dependency installation pattern rather than evidence that the current okrapdf package is malicious.

Attack Path

  1. An attacker compromises the npm package publisher account, registry distribution path, or a transitive dependency.
  2. The attacker publishes a malicious release that becomes the version resolved by the unpinned installation command.
  3. A user follows the documented setup instructions and runs npm install -g okrapdf.
  4. npm downloads the compromised release and may execute its installation lifecycle scripts.
  5. The malicious code executes under the installing user's account and can establish any access available to that account.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running npm. Depending on that user's permissions and environment, this could expose user-accessible files, environment variables, API credentials, agent configuration, and network resources. A malicious package could also replace or modify the globally installed okra e ...[truncated 271 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a specific reviewed version, for example:
    bash
    npm install -g okrapdf@X.Y.Z
  2. Document the expected package integrity digest and require verification against trusted release metadata.
  3. Enable npm provenance and signature verification where available, and publish links to the package's auditable source and release commit.
  4. Prefer a project-local installation with a committed lockfile over a global installation:
    bash
    npm install --save-exact okrapdf@X.Y.Z
npx okra --help
  5. Review package lifecycle scripts and transitive dependencies before approving version updates.
  6. Avoid running npm installation commands with sudo, administrator rights, or other elevated privileges.
  7. Consider recommending --ignore-scripts when lifecycle scripts are not required, after verifying that this does not break legitimate installation behavior.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (36)

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

MCP (Claude Code, Cursor, OpenCode)

Add to ~/.claude/mcp.json or .cursor/mcp.json:

json
{

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
60% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.

HTTP (fanout):

bash
curl -X POST https://api.okrapdf.com/v1/collections/col-xxx/query \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "What was total revenue in Q4?"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill repeatedly instructs users to upload local PDFs and query extracted document contents through a third-party remote API, but it does not warn that sensitive, regulated, or proprietary data will leave the local environment. In an agent context, this omission can cause users or subagents to exfiltrate confidential documents unintentionally because the skill presents remote processing as routine and frictionless.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The MCP server configuration points the agent platform at a third-party remote endpoint and authorizes it with a bearer token, establishing continuous external connectivity. That is not inherently malicious, but it is a meaningful trust and data-egress decision that should be disclosed more explicitly in a security-sensitive skill.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
"mcpServers": {
    "okra-pdf": {
      "type": "url",
      "url": "https://api.okrapdf.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The HTTP example explicitly posts document references or file content to api.okrapdf.com, so it is a real external transmission path. Because the skill lacks adjacent privacy notice, users may not appreciate that local documents are being processed by a third party.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

HTTP

bash
# From URL
curl -X POST https://api.okrapdf.com/v1/documents \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://arxiv.org/pdf/2307.09288"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The HTTP example explicitly posts document references or file content to api.okrapdf.com, so it is a real external transmission path. Because the skill lacks adjacent privacy notice, users may not appreciate that local documents are being processed by a third party.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

HTTP

bash
# From URL
curl -X POST https://api.okrapdf.com/v1/documents \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://arxiv.org/pdf/2307.09288"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The file upload example sends a local PDF directly to a remote service, which is security-relevant whenever documents may contain confidential information. The absence of handling guidance makes accidental disclosure more likely, particularly for users treating this as a convenience tool inside automation.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

-d '{"url": "https://arxiv.org/pdf/2307.09288"}'

From file

curl -X POST https://api.okrapdf.com/v1/documents
-H "Authorization: Bearer $OKRA_API_KEY"
-F "file=@report.pdf" -F "page_images=cover"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

HTTP

bash
curl https://api.okrapdf.com/v1/documents/doc-abc123/status \
  -H "Authorization: Bearer $OKRA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

HTTP

bash
curl https://api.okrapdf.com/v1/documents/doc-abc123/status \
  -H "Authorization: Bearer $OKRA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

HTTP

bash
curl https://api.okrapdf.com/v1/documents/doc-abc123/status \
  -H "Authorization: Bearer $OKRA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

HTTP

bash
curl https://api.okrapdf.com/v1/documents/doc-abc123/status \
  -H "Authorization: Bearer $OKRA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

HTTP

bash
curl https://api.okrapdf.com/v1/documents/doc-abc123/status \
  -H "Authorization: Bearer $OKRA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

HTTP

bash
curl https://api.okrapdf.com/v1/documents/doc-abc123/status \
  -H "Authorization: Bearer $OKRA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

HTTP

bash
curl https://api.okrapdf.com/v1/documents/doc-abc123/status \
  -H "Authorization: Bearer $OKRA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.

HTTP

bash
curl https://api.okrapdf.com/v1/documents/doc-abc123/status \
  -H "Authorization: Bearer $OKRA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 384)May include surrounding context.

HTTP

bash
curl https://api.okrapdf.com/v1/documents/doc-abc123/status \
  -H "Authorization: Bearer $OKRA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 514)May include surrounding context.

HTTP

bash
curl https://api.okrapdf.com/v1/documents/doc-abc123/status \
  -H "Authorization: Bearer $OKRA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Reading full markdown from a remote document endpoint retrieves extracted document content from a third-party service, confirming that document contents are stored and served externally. This matters because users may assume extraction is transient when the skill actually supports later remote retrieval of the content.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

HTTP

bash
# Full markdown
curl https://api.okrapdf.com/v1/documents/doc-abc123/full.md \
  -H "Authorization: Bearer $OKRA_API_KEY"

# Specific page

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

Fetching individual pages from the remote API exposes page-level document content through an external service. This is expected product behavior, but it remains security-sensitive because page retrieval enables targeted access to sensitive sections after upload.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md
-H "Authorization: Bearer $OKRA_API_KEY"

# Specific page
curl "https://api.okrapdf.com/v1/documents/doc-abc123/pages/3" \
  -H "Authorization: Bearer $OKRA_API_KEY"

# All pages as JSON

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The all-pages JSON endpoint provides structured access to the full extracted document content over the network, which is a substantial external data exposure surface. In automation contexts, this may enable bulk downstream copying of sensitive extracted text.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

-H "Authorization: Bearer $OKRA_API_KEY"

All pages as JSON

curl https://api.okrapdf.com/v1/documents/doc-abc123/pages
-H "Authorization: Bearer $OKRA_API_KEY"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

Question-answering requests send prompts tied to specific documents to the external service, potentially revealing both document content and analyst intent. For sensitive corpora, even the questions asked can disclose confidential strategy, investigations, or regulated subject matter.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

HTTP (OpenAI-compatible)

bash
curl -X POST https://api.okrapdf.com/document/doc-abc123/chat/completions \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The JSON-schema extraction example encourages detailed structured extraction from document contents via a third-party endpoint, increasing the value of transmitted data. Extracting invoices, totals, and entities can concentrate sensitive information into machine-readable form, making downstream misuse easier if mishandled.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

HTTP

bash
curl -X POST https://api.okrapdf.com/document/doc-abc123/chat/completions \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The JSON-schema extraction example encourages detailed structured extraction from document contents via a third-party endpoint, increasing the value of transmitted data. Extracting invoices, totals, and entities can concentrate sensitive information into machine-readable form, making downstream misuse easier if mishandled.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

HTTP

bash
curl -X POST https://api.okrapdf.com/document/doc-abc123/chat/completions \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill documents destructive delete operations for documents and collections without warning that deletion may be irreversible or operationally disruptive. In agent-driven workflows, a user or subagent could execute cleanup commands assuming they are safe, causing unintended loss of processed documents or shared collection state.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

Submitting a collection query to the remote service can process multiple documents and synthesize answers externally, materially increasing confidentiality impact. Cross-document analysis often combines sensitive facts in ways users may not expect from a simple query example.

Content

Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.

HTTP (fanout):

bash
curl -X POST https://api.okrapdf.com/v1/collections/col-xxx/query \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "What was total revenue in Q4?"}'