ClawHub
Back to skill

Security audit

Nano Pdf

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small, purpose-aligned wrapper for installing and using the nano-pdf CLI to edit PDFs, with the main caution being an unpinned third-party package install.

Before installing, consider that this skill depends on the current nano-pdf package resolved by uv, not a reviewed fixed version. Use it in a constrained environment when editing sensitive PDFs, review output PDFs before sharing, and prefer a pinned or locked installation if your workflow requires stronger supply-chain control.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-20
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

yaml
"install":
  [
    {
      "id": "uv",
      "kind": "uv",
      "package": "nano-pdf",
      "bins": ["nano-pdf"],
      "label": "Install nano-pdf (uv)",
    },
  ],

Technical Analysis

The skill directs the framework to install the nano-pdf package from PyPI through uv, but it does not specify an exact version or require an integrity hash. Consequently, the code installed at a future point may differ from the code that was available when the skill was reviewed.

No evidence establishes that the current nano-pdf package is malicious. The security issue is the absence of dependency pinning and integrity verification, which creates supply-chain exposure if an upstream account, package release, package repository, or dependency resolution process is compromised. Installation and subsequent execution of the nano-pdf binary run third-party code with the privileges available to the agent or user.

Attack Path

  1. An attacker compromises the upstream package, its publishing account, or another component in its dependency chain.
  2. The attacker publishes a malicious release under the dependency name expected by the skill.
  3. The skill installation process resolves nano-pdf without an exact version or verified hash.
  4. uv downloads and installs the attacker-controlled release.
  5. The installed package executes during installation or when the documented nano-pdf edit command is invoked.
  6. The malicious code operates with the agent or invoking user's permissions and can access resources available in that execution environment.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user or agent installing or invoking the package. Depending on the execution environment, this could ...[truncated 304 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin nano-pdf to an exact version that has undergone security review rather than resolving the latest available release.
  • Use a lockfile that records all transitive dependency versions.
  • Require cryptographic hashes for downloaded distributions and reject artifacts that do not match the approved hashes.
  • Review package provenance, maintainer history, release artifacts, and transitive dependencies before approving upgrades.
  • Perform dependency updates through a controlled review process with automated vulnerability and malware scanning.
  • Execute PDF processing in a sandbox with minimal filesystem access, no unnecessary credentials, and network access disabled unless explicitly required.
  • Grant access only to the input and output files needed for the requested PDF operation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.