ClawHub
Back to skill

Security audit

PDF处理工具

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a PDF helper, but it asks for broad command access and includes unclear external API and API key instructions that are not well scoped to PDF work.

Review before installing. Use it only in a sandbox or trusted workspace, avoid sensitive PDFs unless you know no external API will be used, and do not provide API keys unless the publisher clearly documents the provider, scopes, and data handling. Prefer restricting command execution to known PDF tools and local Python libraries.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill is framed as a PDF-processing utility, but it also advertises external API integration and command execution that are not necessary for the stated local-document workflows. This capability expansion increases attack surface and can enable data exfiltration or arbitrary system interaction under the guise of routine PDF handling.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The document describes a local PDF toolkit that does not perform OCR, yet includes API-oriented failure modes, rate limits, authentication handling, and API key setup inconsistent with that scope. These inconsistencies can conceal unexpected outbound connectivity or confuse reviewers and users about whether uploaded documents or secrets may be sent to external services.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
Granting `exec` to a skill whose stated purpose is PDF manipulation is unjustified and materially dangerous. In an agent setting, shell execution can be abused for arbitrary code execution, filesystem discovery, persistence, or data exfiltration, especially if user-supplied paths or arguments are later incorporated into commands.

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
API integration and API key handling are not justified by the documented local PDF use cases, creating unnecessary secret-management and outbound-data risks. Even if not actively malicious, encouraging API-key configuration in a file-processing skill broadens the blast radius if the skill or its environment is compromised.

Static analysis

No suspicious patterns detected.