Security audit
Security checks for vulnerabilities and agentic risk
This OCR skill appears purpose-aligned, but its install and data-handling paths need review before use.
Review the install commands before running them. Prefer package-manager or verified installer paths instead of curl piped to sh, avoid running setup as root unless necessary, process sensitive documents only against a trusted local Ollama service, and avoid running the PDF converter in directories containing important PNG files whose names match the PDF page prefix.
SKILL.md:21Unpinned Remote Installer Scripts Are Piped Directly to a Shell
hooks/install-deps.sh:7Installation Hook Retrieves Mutable Dependency Metadata Without Integrity Verification
utils/ollama_client.py:21Complete Document Images May Be Transmitted to Arbitrary Hosts Over Plaintext HTTP
utils/pdf_utils.py:20Broad Output Globbing Can Cause Deletion of Unrelated PNG Files
The README instructs users to execute a remote installation script directly with curl ... | sh, which grants immediate code execution from a network source without review or integrity verification. If the upstream site, transport path, or script content is compromised, users can suffer arbitrary code execution on their machine.
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh
ollama pull glm-ocr:q8_0
# Install poppler-utils (for PDF to image conversion)
The | sh chaining pattern is dangerous because it converts downloaded content directly into shell commands without an opportunity for inspection, sandboxing, or validation. In an installation context, this materially increases the likelihood and impact of supply-chain compromise or malicious script substitution.
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh
ollama pull glm-ocr:q8_0
# Install poppler-utils (for PDF to image conversion)
This second | sh pattern has the same issue: a remote network response is executed immediately as shell code. Even if the source is reputable, the practice is unsafe by default and especially problematic in third-party skill documentation that users may follow without scrutiny.
brew install poppler # macOS
curl -LsSf https://astral.sh/uv/install.sh | sh
### Install via ClawHub (Recommended)
The declared description describes a full OCR-based PDF/image-to-Markdown conversion skill with content classification capabilities. The actual code chunk is only a minimal tests package initializer and version declaration, which is unrelated to the declared functionality. This is a material mismatch in primary purpose, not merely an implementation detail.
The declared description promises an intelligent PDF/image to Markdown converter with OCR-based content detection. The supplied code does not implement conversion, OCR, Markdown generation, or document structure detection. Instead, it only offers supporting image-processing helpers such as crop, resize, save, size detection, and base64 encoding. While such utilities could support a larger OCR pipeline, this chunk by itself does not match the declared primary purpose and exposes capabilities not mentioned in the description.
The supplied code chunk is limited to low-level PDF preprocessing and inspection utilities. It invokes external tools (pdftoppm, pdfinfo) to rasterize PDFs, count pages, extract metadata, and validate files. While PDF-to-image conversion could support a larger OCR pipeline, this code does not implement the declared primary functionality of converting PDFs or images into Markdown, nor does it perform intelligent content detection or use Ollama GLM-OCR. Therefore the description materially overstates and misrepresents what this code chunk actually does.
Piping a remote script directly into sh executes unreviewed code from the network with the user's privileges. If the hosting site, network path, or script content is compromised, this becomes an immediate arbitrary code execution and supply-chain compromise vector.
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh
ollama pull glm-ocr:q8_0
# Install poppler-utils (for PDF to image conversion)
The | sh construct chains network retrieval directly into shell execution, removing any opportunity for user inspection or validation before running code. In a skill installation context, this is especially risky because users may copy-paste it verbatim and unknowingly execute attacker-controlled payloads.
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh
ollama pull glm-ocr:q8_0
# Install poppler-utils (for PDF to image conversion)
This second | sh usage has the same unsafe pattern: direct execution of network-fetched code without validation. Even if common in developer tooling, it normalizes insecure installation behavior and increases exposure to supply-chain compromise.
brew install poppler # macOS
curl -LsSf https://astral.sh/uv/install.sh | sh
### 2. Install with uv (Recommended)
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
from pathlib import Path
# Process PDF (auto mode)
subprocess.run([
"python", "skills/pdf-ocr-tool/ocr_tool.py",
"--input", "/path/to/document.pdf",
"--output", "/tmp/result.md",
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
# Check if Ollama is installed
if ! command -v ollama &> /dev/null; then
echo "❌ ollama is not installed. Please install ollama first:"
echo " curl -fsSL https://ollama.com/install.sh | sh"
exit 1
fi
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
RegionType.FIGURE: get_prompt("figure"),
RegionType.MIXED: get_prompt("mixed"),
}
return prompt_map.get(region_type, get_prompt("mixed"))
def _crop_region(
self,
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
RegionType.FIGURE: get_prompt("figure"),
RegionType.MIXED: get_prompt("mixed"),
}
return prompt_map.get(region_type, get_prompt("mixed"))
def _crop_region(
self,
The README describes OCR processing via Ollama but does not clearly warn users that document contents are transmitted to a local or remote Ollama service endpoint during processing. This can cause unintended disclosure of sensitive PDFs or images, especially when --host is configured to point at a non-local service.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
sudo apt install poppler-utils # Debian/Ubuntu
brew install poppler # macOS
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
sudo apt install poppler-utils # Debian/Ubuntu
brew install poppler # macOS
The skill advertises and demonstrates capabilities involving file access, network access, and shell execution, but does not declare any explicit tool scope or permissions boundary. This increases the risk of over-privileged execution because operators and agents cannot easily constrain what the skill is allowed to do before installation or use.
The skill documentation does not clearly warn that user-provided PDFs or images may be transmitted to an OCR service via Ollama for processing. This is a data-handling transparency issue that can lead users to expose sensitive local documents without understanding the privacy boundary.
Using npx clawhub install pdf-ocr-tool without a pinned package version makes installation dependent on whatever package version is current at execution time. That creates a supply-chain risk where a compromised or maliciously updated package could be fetched and run unexpectedly.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# Clone or download skill
git clone <repo> ~/.openclaw/workspace/skills/pdf-ocr-tool
# Create virtual environment and install dependencies
cd ~/.openclaw/workspace/skills/pdf-ocr-tool
uv venv
source .venv/bin/activate
Comments, docstrings, prompts, and printed messages in this file are written in Chinese only, with no indication that users can choose another language. This creates a locale/language policy concern because the skill effectively enforces one language without explicit user preference or justified regional scope.
This code sends the page image to self.ollama_client.generate(...) for analysis, which is a network/model call that may transmit user document data. While there is exception logging, there is no confirmation prompt, user-facing disclosure, or explanatory comment/docstring warning that page contents are being sent for external processing.
After cropping, the code submits the temporary image file to self.ollama_client.generate(...), which may transmit sensitive page-region content for remote processing. The surrounding code lacks any confirmation prompt, disclosure comment, or documentation warning about this data transmission.
The install hook downloads dependency definition files from a remote GitHub URL when local files are absent, introducing a supply-chain risk during installation. Because those fetched files control what packages are installed, a compromised repository, branch, account, or network path could cause execution of attacker-chosen dependencies or build steps.
No suspicious patterns detected.