Nano Pdf Cn

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:49 PM UTC
• Version: 1.0.0

Overview

This skill is a small, purpose-aligned wrapper for a PDF editing CLI, with a supply-chain and document-privacy caution from its external dependency.

Before installing, consider whether you are comfortable installing an unpinned third-party CLI and processing PDFs through its external AI workflow. Use a sandbox or pinned reviewed version for sensitive documents, and review the generated PDF before sharing it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"📄","requires":{"bins":["nano-pdf"]},"install":[{"id":"uv","kind":"uv","package":"nano-pdf","bins":["nano-pdf"],"label":"Install nano-pdf (uv)"}]}}

Technical Analysis

The installation configuration retrieves the third-party nano-pdf package by name without specifying an exact version, integrity hash, signature, or locked transitive dependency set. Consequently, the package version installed can change after this Skill has been reviewed.

No evidence in the audited files establishes that the current PyPI package is malicious. However, the unpinned installation creates a supply-chain exposure: compromise of the package publisher account, publication of a malicious future version, or compromise of a transitive dependency could introduce code that was not included in this audit. Python packages may execute code during installation or when their command-line entry points are invoked.

Attack Path

1. An attacker compromises the nano-pdf publishing account, its release pipeline, or one of its dependencies and publishes a malicious release.
2. A user or Agent installs this Skill in an environment where nano-pdf is absent.
3. The installer resolves package: "nano-pdf" to the attacker-controlled release because no exact version or integrity constraint is present.
4. Malicious package code executes during installation or when the documented nano-pdf edit command is invoked.
5. The code operates with the privileges and filesystem access of the installing or invoking process.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the Agent or user's account. The resulting access may include the ability to read or modify PDFs supplied for editing, access other files availa ...[truncated 379 chars]

Remediation

View remediation

Remediation Suggestions

• Pin nano-pdf to a specific, reviewed version rather than resolving the latest available release.
• Verify package artifacts with approved cryptographic hashes or signatures.
• Use a lock file or equivalent mechanism to constrain and verify all transitive dependencies.
• Review the selected package version, release provenance, installation hooks, and command-line entry point before approval.
• Install and execute the dependency in a sandbox or container with minimal filesystem permissions, restricted network access, and no unnecessary credentials.
• Establish an explicit update process in which new versions are reviewed and their hashes updated deliberately rather than being adopted automatically.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep