ClawHub
Back to skill

Security audit

Pub Nanopdf

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a broad third-party AI and messaging API gateway, not a focused PDF editing skill, and it can send user content plus email or SMS actions through an external service.

Install only if you intentionally want a broad SkillBoss API gateway, not just PDF editing. Treat prompts, documents, media, URLs, phone numbers, and message contents as data sent to an external service and possibly downstream providers. Use a restricted API key, avoid sensitive or regulated data, and require manual confirmation before any email, SMS, scraping, or file-writing workflow.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T07 · Tool Hijacking and Spoofing

Warning
Location
audio-models.md:29
Finding

Untrusted PATH Resolution for Undeclared Audio Model Runner

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
chat-models.md:31
Finding

Untrusted PATH Resolution for Undeclared Chat Model Runner

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
image-models.md:22
Finding

Untrusted PATH Resolution for Undeclared Image Model Runner

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
video-models.md:9
Finding

Untrusted PATH Resolution for Undeclared Video Model Runner

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (38)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The manifest and description present this as a narrowly scoped PDF-editing skill, but the content actually exposes a broad proxy to many unrelated third-party AI, search, scraping, email, and SMS services. This scope mismatch is dangerous because users and policy systems may grant trust or invoke the skill for benign document editing while unintentionally enabling external communications and data transfer far beyond that purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Including email sending and SMS verification in a skill marketed for PDF editing introduces powerful outbound action channels unrelated to user expectations. If invoked with user-controlled inputs, these capabilities could send messages to external recipients, trigger OTP workflows, or facilitate spam, phishing, or unwanted notifications using the configured API key.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documentation does not warn that prompts, documents, images, audio, phone numbers, and other user data may be transmitted to an external aggregator and downstream providers. This omission creates a privacy and trust risk because users may provide sensitive content under the assumption of local PDF editing rather than broad third-party processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

List Models

bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

Chat requests send user prompts and possibly conversation context to an external service aggregator and downstream model providers. In the context of a misrepresented PDF skill with no privacy warning, this creates a meaningful risk of unanticipated data sharing.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Chat

bash
curl -s -X POST https://api.heybossai.com/v1/chat/completions \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This duplicate finding again reflects prompt transmission to external image-generation services. The risk comes from unnecessary, undisclosed third-party data transfer in a skill whose scope does not match its advertised purpose.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Image Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This duplicate finding again reflects prompt transmission to external image-generation services. The risk comes from unnecessary, undisclosed third-party data transfer in a skill whose scope does not match its advertised purpose.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Image Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

This workflow not only submits prompts externally but also downloads a returned asset URL to a local file, increasing interaction with remote content beyond simple inference. That expands the attack surface and should not be present in a narrowly scoped PDF-editing skill without strong disclosure and validation.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Save to file:

bash
URL=$(curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This duplicate finding covers video-generation prompt transmission to an external API. The contextual risk remains the same: unrelated feature scope and undisclosed off-platform processing of user content.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Video Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This duplicate finding covers video-generation prompt transmission to an external API. The contextual risk remains the same: unrelated feature scope and undisclosed off-platform processing of user content.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Video Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The image-to-video example sends both prompt text and a user-specified image URL to an external provider, potentially exposing private media references or enabling processing of untrusted remote content. This is more dangerous than simple text-only use because it combines external retrieval and third-party media handling.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Image-to-video:

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This duplicate finding again indicates third-party transmission of user text for TTS processing. The security concern is the undocumented off-platform handling of user content in a misleadingly scoped skill.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Text-to-Speech

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This duplicate finding again indicates third-party transmission of user text for TTS processing. The security concern is the undocumented off-platform handling of user content in a misleadingly scoped skill.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Text-to-Speech

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This duplicate STT finding again highlights export of potentially sensitive audio to an external provider. The lack of purpose alignment and privacy notice increases the practical risk.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Speech-to-Text

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This duplicate STT finding again highlights export of potentially sensitive audio to an external provider. The lack of purpose alignment and privacy notice increases the practical risk.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Speech-to-Text

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

Music-generation prompts are sent to an external service unrelated to the stated PDF-editing purpose. This broadens the skill into a generic multimodal gateway and increases the risk of inappropriate or unexpected data egress.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Music Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

This duplicate background-removal finding reflects sharing image inputs with an external provider outside the expected scope of PDF editing. The issue is primarily improper scope and missing disclosure, not covert exfiltration.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Background Removal

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

This duplicate background-removal finding reflects sharing image inputs with an external provider outside the expected scope of PDF editing. The issue is primarily improper scope and missing disclosure, not covert exfiltration.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Background Removal

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Document processing sends a document URL to a third-party parser, which may expose sensitive file contents to external services. In a document-related skill this can be contextually justified, but the lack of explicit privacy and provider-routing warnings still makes it security-relevant.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

Document Processing

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

This duplicate web-search finding again represents external transmission of user queries to third-party services outside the advertised PDF-editing scope. The mismatch and lack of warning drive the risk.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

Web Search

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.