ClawHub
Back to skill

Security audit

OkraPDF

Security checks for vulnerabilities and agentic risk

Overview

OkraPDF is a coherent remote PDF-processing skill, but users should treat uploaded documents, prompts, and exports as data shared with an external service.

Install only if you trust OkraPDF with the PDFs and prompts you plan to process. Avoid uploading secrets, regulated records, customer data, or proprietary documents unless the provider and its retention policy are approved for that data. Use a dedicated API key, store it securely, review global npm package provenance, and require explicit confirmation before running delete, export, sandbox, or large parallel collection operations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (29)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill repeatedly instructs users and agents to upload PDFs and query extracted content through a third-party remote service, but it does not include any privacy, retention, sensitivity, or data-handling warning. In an agent context, that omission is risky because users may send confidential PDFs, regulated data, or internal documents off-platform without informed consent.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation includes delete operations for documents and collections without any warning about irreversibility, access checks, or confirmation guidance. In agent-driven workflows, destructive commands can be triggered automatically or by prompt confusion, leading to unintended data loss.

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP
```bash
# From URL
curl -X POST https://api.okrapdf.com/v1/documents \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://arxiv.org/pdf/2307.09288"}'
Confidence
89% confidence
Finding
This example sends a document URL or uploaded file to an external Okra API endpoint, which is an external data transmission. The behavior is core to the skill, but without surrounding safety guidance it can expose sensitive document contents or metadata to a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP
```bash
curl -X POST https://api.okrapdf.com/document/doc-abc123/chat/completions \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
86% confidence
Finding
The structured-data extraction example sends document-derived content and prompts to a remote chat/completions endpoint. This can disclose sensitive document text, extracted entities, and business questions to an external processor if used on confidential materials.

External Transmission

Medium
Category
Data Exfiltration
Content
**HTTP (fanout):**
```bash
curl -X POST https://api.okrapdf.com/v1/collections/col-xxx/query \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "What was total revenue in Q4?"}'
Confidence
88% confidence
Finding
The collections query endpoint transmits cross-document questions and associated document context to a remote service. Because collections aggregate multiple documents, accidental disclosure scope is larger and may expose sensitive information across datasets in a single operation.

External Transmission

Medium
Category
Data Exfiltration
Content
# Fan-out: same question to multiple docs in parallel
for doc_id in doc-abc123 doc-def456 doc-ghi789; do
  curl -s -X POST "https://api.okrapdf.com/document/$doc_id/chat/completions" \
    -H "Authorization: Bearer $OKRA_API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"messages\": [{\"role\": \"user\", \"content\": \"What was total revenue?\"}], \"stream\": false}" &
Confidence
87% confidence
Finding
The fan-out loop sends parallel requests containing document queries to an external endpoint, amplifying outbound transmission and the potential exposure surface. Parallelization can make accidental bulk exfiltration faster if misused by an agent or script.

External Transmission

Medium
Category
Data Exfiltration
Content
"mcpServers": {
    "okra-pdf": {
      "type": "url",
      "url": "https://api.okrapdf.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
Confidence
82% confidence
Finding
The MCP configuration connects the local agent environment to a remote MCP server and authorizes it with an API key, creating an external transmission path. This is expected functionality, but it still deserves disclosure because agent prompts and tool inputs may leave the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP
```bash
# From URL
curl -X POST https://api.okrapdf.com/v1/documents \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://arxiv.org/pdf/2307.09288"}'
Confidence
89% confidence
Finding
This example sends a document URL or uploaded file to an external Okra API endpoint, which is an external data transmission. The behavior is core to the skill, but without surrounding safety guidance it can expose sensitive document contents or metadata to a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"url": "https://arxiv.org/pdf/2307.09288"}'

# From file
curl -X POST https://api.okrapdf.com/v1/documents \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -F "file=@report.pdf" -F "page_images=cover"
```
Confidence
89% confidence
Finding
The file upload example explicitly sends a local PDF to an external endpoint, which is a direct content exfiltration path from the user's machine to a third-party service. This is intended behavior, but the lack of privacy warning makes it materially risky in enterprise or regulated contexts.

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP
```bash
# Full markdown
curl https://api.okrapdf.com/v1/documents/doc-abc123/full.md \
  -H "Authorization: Bearer $OKRA_API_KEY"

# Specific page
Confidence
84% confidence
Finding
Reading full markdown content from the remote service retrieves extracted document text over the network and normalizes dependence on external storage of document contents. In practice, this means sensitive content has already been uploaded and remains accessible remotely.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer $OKRA_API_KEY"

# Specific page
curl "https://api.okrapdf.com/v1/documents/doc-abc123/pages/3" \
  -H "Authorization: Bearer $OKRA_API_KEY"

# All pages as JSON
Confidence
80% confidence
Finding
Fetching specific pages from the service is remote document-content access and confirms that page-level data is externally available. The exposure is narrower than full-document retrieval, but still relevant for sensitive documents.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer $OKRA_API_KEY"

# All pages as JSON
curl https://api.okrapdf.com/v1/documents/doc-abc123/pages \
  -H "Authorization: Bearer $OKRA_API_KEY"
```
Confidence
82% confidence
Finding
Retrieving all pages as JSON from the remote API exposes structured page content and metadata from an externally stored document. Structured exports may be easier to ingest into downstream systems, increasing secondary spread of sensitive content.

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP (OpenAI-compatible)
```bash
curl -X POST https://api.okrapdf.com/document/doc-abc123/chat/completions \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
86% confidence
Finding
The chat/completions example sends questions and document context to a remote endpoint for answer generation. In agent workflows, those prompts often include sensitive business intent or summaries, so this is a meaningful external disclosure point.

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP
```bash
curl -X POST https://api.okrapdf.com/document/doc-abc123/chat/completions \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
86% confidence
Finding
The structured-data extraction example sends document-derived content and prompts to a remote chat/completions endpoint. This can disclose sensitive document text, extracted entities, and business questions to an external processor if used on confidential materials.

External Transmission

Medium
Category
Data Exfiltration
Content
### HTTP
```bash
curl https://api.okrapdf.com/v1/documents/doc-abc123/entities/tables \
  -H "Authorization: Bearer $OKRA_API_KEY"

curl https://api.okrapdf.com/v1/documents/doc-abc123/entities \
Confidence
78% confidence
Finding
Table/entity retrieval from the API is remote access to extracted document artifacts. While expected, it still reflects that processed contents are stored externally and may contain sensitive data such as financial tables or embedded images.

External Transmission

Medium
Category
Data Exfiltration
Content
curl https://api.okrapdf.com/v1/documents/doc-abc123/entities/tables \
  -H "Authorization: Bearer $OKRA_API_KEY"

curl https://api.okrapdf.com/v1/documents/doc-abc123/entities \
  -H "Authorization: Bearer $OKRA_API_KEY"
```
Confidence
78% confidence
Finding
Listing entities for a document uses the external service to return extracted artifacts, which may include sensitive metadata or content-derived objects. This is part of normal functionality but should be disclosed as remote processing/storage.

External Transmission

Medium
Category
Data Exfiltration
Content
**HTTP:**
```bash
# Create with seed documents
curl -X POST https://api.okrapdf.com/v1/collections \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Q4 Earnings", "document_ids": ["doc-abc123", "doc-def456"]}'
Confidence
76% confidence
Finding
Creating a collection sends document identifiers and collection metadata to the external service. This is less sensitive than raw content upload, but can still reveal project names, grouping semantics, and corpus membership.

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"name": "Q4 Earnings", "document_ids": ["doc-abc123", "doc-def456"]}'

# Add documents
curl -X POST https://api.okrapdf.com/v1/collections/col-xxx/documents \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"document_ids": ["doc-ghi789"]}'
Confidence
76% confidence
Finding
Adding documents to a collection transmits corpus composition to the external service. Membership itself may be sensitive, especially for legal, M&A, or investigation-related document sets.

External Transmission

Medium
Category
Data Exfiltration
Content
# List / get / delete
curl https://api.okrapdf.com/v1/collections -H "Authorization: Bearer $OKRA_API_KEY"
curl https://api.okrapdf.com/v1/collections/col-xxx -H "Authorization: Bearer $OKRA_API_KEY"
curl -X DELETE https://api.okrapdf.com/v1/collections/col-xxx -H "Authorization: Bearer $OKRA_API_KEY"
```

### Query across documents
Confidence
85% confidence
Finding
The delete request is a remote state-changing operation against externally stored data. While not a transmission-of-content issue per se, it is security-relevant because it can permanently remove data and the docs provide no confirmation or safeguard guidance.

External Transmission

Medium
Category
Data Exfiltration
Content
**HTTP (fanout):**
```bash
curl -X POST https://api.okrapdf.com/v1/collections/col-xxx/query \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "What was total revenue in Q4?"}'
Confidence
88% confidence
Finding
The collections query endpoint transmits cross-document questions and associated document context to a remote service. Because collections aggregate multiple documents, accidental disclosure scope is larger and may expose sensitive information across datasets in a single operation.

External Transmission

Medium
Category
Data Exfiltration
Content
**HTTP (sandbox):**
```bash
curl -X POST https://api.okrapdf.com/v1/collections/col-xxx/query \
  -H "Authorization: Bearer $OKRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "Compare R&D spending. Show a table.", "mode": "sandbox"}'
Confidence
90% confidence
Finding
The sandbox mode explicitly describes a single LLM with grep/Python operating over all documents in a collection, implying broad remote processing over aggregated document contents. In a multi-document corpus, this materially increases the blast radius for sensitive data disclosure and downstream analysis by a third-party execution environment.

External Transmission

Medium
Category
Data Exfiltration
Content
### Export
```bash
# NDJSON stream
curl -N "https://api.okrapdf.com/v1/collections/col-xxx/export?format=markdown" \
  -H "Authorization: Bearer $OKRA_API_KEY"

# Zip archive
Confidence
79% confidence
Finding
Exporting a collection as markdown streams combined document content from the external service, enabling bulk retrieval of potentially sensitive material. Bulk export increases the chance of unauthorized redistribution or mishandling.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer $OKRA_API_KEY"

# Zip archive
curl -L "https://api.okrapdf.com/v1/collections/col-xxx/export?format=zip" \
  -H "Authorization: Bearer $OKRA_API_KEY" -o collection.zip
```
Confidence
80% confidence
Finding
The zip export downloads a bulk archive of collection contents from the external service, making mass extraction straightforward. Bulk archives are especially sensitive because they are easy to copy, retain, and share outside intended controls.

External Transmission

Medium
Category
Data Exfiltration
Content
okra extract report.pdf -o json -q > report.json

# HTTP
curl https://api.okrapdf.com/exports/doc-abc123/markdown -H "Authorization: Bearer $OKRA_API_KEY"
curl -o report.xlsx https://api.okrapdf.com/exports/doc-abc123/excel -H "Authorization: Bearer $OKRA_API_KEY"
curl -o report.docx https://api.okrapdf.com/exports/doc-abc123/docx -H "Authorization: Bearer $OKRA_API_KEY"
curl https://api.okrapdf.com/exports/doc-abc123/snapshot -H "Authorization: Bearer $OKRA_API_KEY"
Confidence
80% confidence
Finding
Export endpoints for markdown/excel/docx/snapshot facilitate retrieval of processed document content from the remote service. Multiple export formats increase the avenues for secondary leakage and make sensitive data easier to propagate.

External Transmission

Medium
Category
Data Exfiltration
Content
# HTTP
curl https://api.okrapdf.com/exports/doc-abc123/markdown -H "Authorization: Bearer $OKRA_API_KEY"
curl -o report.xlsx https://api.okrapdf.com/exports/doc-abc123/excel -H "Authorization: Bearer $OKRA_API_KEY"
curl -o report.docx https://api.okrapdf.com/exports/doc-abc123/docx -H "Authorization: Bearer $OKRA_API_KEY"
curl https://api.okrapdf.com/exports/doc-abc123/snapshot -H "Authorization: Bearer $OKRA_API_KEY"
```
Confidence
79% confidence
Finding
The Excel export retrieves structured document content in a highly reusable format from the external service. Structured exports can make extraction of financial, personal, or operational data especially easy to reuse or leak.

Static analysis

No suspicious patterns detected.