ClawHub
Back to skill

Security audit

Pdf Generation

Security checks across malware telemetry and agentic risk

Overview

This is a PDF-making helper that creates local PDF files and shows no hidden executable, network, credential, or destructive behavior.

Installers should expect this skill to create local PDF files. When using it, specify the filename and destination, avoid overwriting existing documents, and review any password, permission, or signature settings before sharing the generated PDF.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger phrases include very generic terms such as '创建pdf', '制作PDF', and especially 'meta-skill-system', which can match many ordinary user requests and cause this skill to activate unexpectedly. Over-broad activation increases the chance that a file-writing skill is invoked in contexts where the user did not clearly intend PDF generation, expanding attack surface and enabling unintended downstream actions.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly instructs generating and saving a '.pdf' file but does not require user confirmation, disclose overwrite/location behavior, or warn that it will write to the user's environment. In an agent setting, silent file creation can lead to unexpected persistence, accidental overwrites, or social-engineering style delivery of documents the user did not knowingly authorize.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.