ClawHub

Doc Converter

Security checks across malware telemetry and agentic risk

Overview

This is a local document converter, with one important caution: its HTML-to-PDF mode can read local files referenced by the HTML into the generated PDF.

Install only if you are comfortable running local conversion commands and installing the listed dependencies. Convert trusted files, and avoid using the HTML-to-PDF path on HTML from other people unless you run it in a sandbox or controlled directory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The security notes state the skill performs only local file processing and does not expose extra risk, but the HTML→PDF path explicitly enables wkhtmltopdf local file access. With untrusted HTML, that can permit inclusion of arbitrary local files referenced by file:// URLs into the rendered output, so the documentation materially understates the capability and risk.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The wkhtmltopdf invocation includes --enable-local-file-access while processing user-supplied HTML. That grants the renderer permission to read local files referenced by the HTML, which is an unnecessary capability for untrusted document conversion and can lead to local file disclosure in the generated PDF.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal