ClawHub
Back to skill

Security audit

PDF工具包（专业版）

Security checks for vulnerabilities and agentic risk

Overview

This PDF skill appears intended for document processing, but its documentation overstates security and integration features and includes unsafe examples that users should review before installing.

Install only if you are comfortable reviewing and constraining the agent's file and Bash access. Use a virtual environment, pin and verify dependencies, avoid confidential documents until logging and output paths are understood, require explicit output paths and overwrite confirmation, and never use the documented default_pass value for encryption.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:83
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 83-88
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

Vulnerable Code

bash
# Ensure the Python environment is available
python3 --version
# ...
# Dependencies
pip install requests

Additional dependency installation instructions appear at lines 345-350:

text
| Dependency | Type | Required | Installation |
| pypdf | Python library | Required | pip install pypdf |
| pdfplumber | Python library | Recommended | pip install pdfplumber |
| reportlab | Python library | Optional | pip install reportlab |

Technical Analysis

The Skill instructs an agent to install packages from the configured Python package index without pinning exact versions, validating package hashes, using a lockfile, or identifying a trusted repository. Package names alone resolve to mutable artifacts and dependency trees at installation time.

This creates a supply-chain boundary in which the code eventually executed is not fully represented by the reviewed Skill. If a package release, maintainer account, package index, transitive dependency, or local package-index configuration is compromised, installation may introduce attacker-controlled code. Python packages can execute build hooks during installation, while malicious runtime code can execute when the installed modules are imported.

No evidence shows that the named packages are currently malicious. The confirmed issue is the unsafe, non-reproducible dependency acquisition practice.

Attack Path

  1. An agent loads the Skill and follows its dependency setup instructions.
  2. The agent runs an unpinned command such as pip install requests or pip install pypdf.
  3. pip resolves the latest matching package and transitive dependencies from its configured index.
  4. A compromised package, dependency, repository account, or index configuration supplies ma ...[truncated 836 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to an exact, reviewed version.
  2. Commit a lockfile that captures the complete transitive dependency graph.
  3. Require cryptographic hashes during installation, such as with pip install --require-hashes -r requirements.txt.
  4. Use an explicitly configured, trusted package index or an internally curated artifact repository.
  5. Scan dependencies for known vulnerabilities and review updates before changing locked versions.
  6. Install packages in an isolated virtual environment or container under a non-privileged account.
  7. Separate dependency installation from normal Skill execution and require explicit user approval before modifying the environment.
  8. Remove the unexplained requests dependency if the Skill does not use it.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:222
Finding

Predictable Hard-Coded Password in Batch PDF Encryption

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 222-236
Vulnerability Type: Hard-coded and predictable encryption credential
Risk Level: Medium

Vulnerable Code

python
    def batch_process(self, file_list: List[str],
                     operations: List[str],
                     output_dir: str = "./output") -> List[PDFOperationResult]:
        """Batch processing (PRO only)"""
mkdir(exist_ok=True)
        results = []
        for file_path in file_list:
            for op in operations:
                output_path = str(Path(output_dir) / Path(file_path).name)
                if op == "compress":
                    r = self.compress(file_path, output_path)
                elif op == "encrypt":
encrypt(file_path, output_path, "default_pass")
                elif op == "extract_text":
                    text = self.extract_text(file_path)
                    r = PDFOperationResult(op, file_path, "", "success",
                                          {"text_length": len(text)})

Technical Analysis

The batch-encryption branch embeds the fixed password default_pass. A static, publicly documented password does not provide meaningful confidentiality because every encrypted output produced from this workflow can share the same known credential.

The surrounding sample contains incomplete syntax and an unqualified encrypt call, so it is not directly runnable as written. Nevertheless, agents are expected to interpret and adapt the Skill's examples. An agent that repairs the syntax while preserving the documented password would generate predictably encrypted files.

The issue is limited to the batch-processing example. The separate encrypt method accepts a caller-supplied password and does not itself contain a fixed credential.

Attack Path

  1. A user or automated workflow requests batch PDF encryption.
  2. An agent implements or repairs the documented `batch ...[truncated 925 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the default_pass fallback entirely.
  2. Require the caller to provide a password or a reference to a managed secret before enabling encryption.
  3. Reject missing, common, or weak passwords with explicit validation.
  4. Generate a unique cryptographically random password when automated generation is appropriate, and deliver it through a separate protected channel.
  5. Do not include passwords in source files, examples, command histories, audit reports, exceptions, or ordinary logs.
  6. Use a secrets manager for service-based workflows and limit secret access to the relevant operation.
  7. Define the intended PDF encryption algorithm and verify that the deployed pypdf version applies an approved strong mode.
  8. Add tests confirming that batch encryption fails closed when no password or managed secret is supplied.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill claims broad PDF, API, webhook, OCR, conversion, and command-execution capabilities that are not actually implemented in the embedded code. This mismatch can mislead an agent or user into assuming unsupported security controls and behaviors exist, increasing the chance of unsafe deployment decisions, incorrect trust assumptions, or accidental exposure of documents to ad hoc follow-on steps.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill describes file-creating and file-modifying PDF operations without clearly warning users that local files may be overwritten, generated, encrypted, or altered. In a document-processing skill with Read/Write/Edit/Bash capabilities, missing disclosure increases the risk of unintended data loss, corruption, or modification of sensitive documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The batch-processing and audit-reporting sections do not clearly warn that multiple user documents may be processed together and that operation histories or logs may retain sensitive filenames, metadata, or extracted content. This is especially risky in an enterprise PDF context where documents commonly contain confidential material and the skill explicitly promotes audit logging.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document gives contradictory guidance about whether API keys are required, which can cause operators to misconfigure the skill or handle credentials unsafely. Confusion around credential requirements is security-relevant because users may paste secrets into prompts, files, or code when the proper secret-handling path is unclear.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill advertises external API integration even though the provided implementation only performs local file operations. This can create false assumptions about network behavior, data sharing, logging, authentication boundaries, and compliance obligations, leading users to trust nonexistent controls or deploy the skill in inappropriate environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill states that it can execute commands in a safe sandbox, but no such behavior or sandboxing mechanism is present in the code. In a skill with Bash access, inaccurate claims about sandboxing are dangerous because they may cause users or orchestrators to approve risky operations under a false belief that isolation protections are in place.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.