ClawHub
Back to skill

Security audit

PDF Utils

Security checks for vulnerabilities and agentic risk

Overview

This PDF utility does what it claims, but its install instructions bypass Python package safety protections and use unpinned dependencies.

Review the install step before using this skill. Prefer installing it in a virtual environment with pinned, audited dependencies rather than running the documented --break-system-packages command. Use --download only when you are comfortable contacting arXiv and writing downloaded PDFs to the chosen output directory, and treat PDFs from unknown sources as untrusted parser inputs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:50
Finding

Unpinned Dependencies Installed with System Package Protections Disabled

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:50-54, README.md:36-41, pyproject.toml:1-3, and pyproject.toml:24-29
Vulnerability Type: Insecure dependency installation and insufficient version integrity controls
Risk Level: Medium

Vulnerable Code

SKILL.md:50-54:

bash
brew install tesseract
brew install tesseract-lang
pip3 install pytesseract Pillow pymupdf --break-system-packages

README.md:36-41:

bash
# OCR engine (macOS)
brew install tesseract
brew install tesseract-lang

# Python dependencies
pip3 install pytesseract Pillow pymupdf --break-system-packages

pyproject.toml:1-3:

toml
[build-system]
requires = ["setuptools>=61.0", "wheel"]
build-backend = "setuptools.build_meta"

pyproject.toml:24-29:

toml
dependencies = [
    "pymupdf>=1.23.0",
    "pytesseract>=0.3.10",
    "Pillow>=10.0.0",
]

Technical Analysis

The project specifies only lower bounds for its runtime and build dependencies. It provides no lockfile, exact version constraints, package hashes, or verified artifact source. Consequently, installation may resolve to future package releases that were not reviewed with this Skill.

The documented pip command also uses --break-system-packages. This option bypasses Python's externally managed environment protection and permits pip to modify an operating-system-managed Python installation. It increases the potential scope of dependency compromise and may overwrite or conflict with packages used by other applications.

No evidence was found that the currently named dependencies are malicious or typosquatted. The vulnerability is the absence of reproducible dependency integrity controls combined with instructions to disable an environment safety boundary.

Attack Path

  1. A user follows the installation instructions in SKILL.md or README.md.
  2. Pip queries the user's configured package ...[truncated 1237 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove --break-system-packages from all installation instructions.

  2. Require installation in an isolated virtual environment:

    bash
    python3 -m venv .venv
. .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install -r requirements.lock --require-hashes

  3. Pin runtime and build dependencies to exact, reviewed versions instead of unrestricted lower bounds.

  4. Generate and commit a lockfile containing hashes for every direct and transitive dependency.

  5. Install with --require-hashes so altered or substituted artifacts are rejected.

  6. Define and document trusted package indexes explicitly, and avoid untrusted extra indexes.

  7. Regularly review pinned versions for published vulnerabilities and update them through a controlled testing process.

  8. Add continuous-integration checks that reject unpinned dependencies and verify lockfile integrity.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_refs.py (reported line 115)May include surrounding context.

python
print(f"  [{i:02d}/{len(arxiv_ids)}] download {aid}...", end=" ", flush=True)

        try:
            result = subprocess.run(
                ["curl", "-sL", url, "-o", out_path, "-m", str(timeout)],
                capture_output=True,
                timeout=timeout + 5,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ocr_pdf.py (reported line 40)May include surrounding context.

python
)

    try:
        result = subprocess.run(
            ["tesseract", "--list-langs"],
            capture_output=True,
            text=True,

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The markdown documents a --download workflow and output directory, which implies outbound network access and saving downloaded files locally. The section presents this as a quick-start command but does not disclose the privacy/system impact of contacting external services or writing multiple files.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
87% confidence
Finding

The unpinned wheel build dependency permits resolver drift to versions with known advisories, preventing verification that package builds use a safe release. Although this is a build-time concern, compromised packaging tools can affect artifact integrity and developer or CI environments.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: wheel has 4 known advisory(ies) (CVE-2026-24049 (Wheel Affected by Arbitrary File Permission Modification via Path Traversal in w); CVE-2022-40898 (pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)); CVE-2022-40898 (An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlie) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
87% confidence
Finding

The unpinned wheel build dependency permits resolver drift to versions with known advisories, preventing verification that package builds use a safe release. Although this is a build-time concern, compromised packaging tools can affect artifact integrity and developer or CI environments.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pymupdf has 2 known advisory(ies) (CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py); CVE-2026-3029 (PyMuPDF has a path traversal in _main_.py)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The dependency specification pymupdf>=1.23.0 is not pinned to an exact version, so builds may resolve to different releases over time, making it impossible to verify from this manifest alone whether a vulnerable version is installed. In a PDF-processing skill that handles untrusted document content, uncertainty around library versioning increases supply-chain and exposure risk, especially when the package has known advisories.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
96% confidence
Finding

Pillow>=10.0.0 allows installation of any later version, so the manifest does not guarantee that a non-vulnerable release will be used. Because this skill performs OCR/PDF/image processing, Pillow is likely to parse attacker-controlled image data, making unresolved dependency drift materially more dangerous than in a non-parser context.

Content

No source excerpt is available for this finding.