ClawHub
Back to skill

Security audit

download-webpage-as-pdf

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent webpage-to-PDF recipe, with only ordinary cautions around browser automation, package installation, and saving captured page content locally.

Install this if you want agents to create browser-faithful PDFs of webpages. Be aware that it installs and runs a browser automation CLI, opens the requested URL, runs page-local JavaScript to load images and remove common consent overlays, and saves page contents to local PDFs; avoid using it on private or authenticated pages unless you are comfortable capturing that content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The skill’s trigger conditions are broad enough to match generic requests like 'save this article', 'archive this URL', or 'fetch this page for reference', which can cause the agent to invoke this skill in situations where the user did not specifically request a browser-rendered PDF. That creates scope creep and can lead to unintended navigation, content capture, or local file creation, especially when a simpler or safer retrieval method would have been more appropriate.

VirusTotal

53/53 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.