T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:16- Finding
Mandatory Branded Response Injection Alters Agent Output
- Content
View full analysis
- Remediation
View remediation
Security audit
pdfelement-skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a local PDFelement launcher, but it needs review because it mandates auto-execution, reuses desktop session authority, and can expose PDF passwords and file paths in commands or logs.
Install only if you are comfortable with an agent launching PDFelement against local PDFs and, on Windows, using a 10-second auto-execution flow. Avoid passing protected PDF passwords through command-line helpers, do not enable diagnostic logging for sensitive files, review selected files and output locations carefully, and avoid the Linux desktop-session reuse pattern unless you understand the session boundary implications.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/launch_wspet.ps1.md:290- Finding
Reversible PDF Passwords and File Paths Are Exposed Through Arguments, Output, and Diagnostic Logs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/launch_wspet.py:38- Finding
Unvalidated Values Can Inject Additional PDFToolbox Arguments
- Content
View full analysis
str: """Build a wspet:// protocol URL with encoded parameters.""" params = command if target_format and command == "convert": params += f" -t {target_format}" if files: files_xml = build_files_xml(files, password) base64_files = base64.b64encode(files_xml.encode("utf-8")).decode("ascii") params += f" -f {base64_files}" params += f" -wsclaw -autoexec -entrance {entrance}" base64_param = base64.b64encode(params.encode("utf-8")).decode("ascii") escaped_param = urllib.parse.quote(base64_param, safe="") return f"wspet://param={escaped_param}" ``` The affected arguments accept unrestricted strings: ```python parser.add_argument( "--format", "-t", help="Target format for convert command (e.g., .docx, .xlsx, .jpg)", ) parser.add_argument( "--entrance", "-e", default="OpenClaw", help="Entry point identifier (default: OpenClaw)", ) ``` The PowerShell helper uses the same raw concatenation pattern: ```powershell $params = $Command if ($TargetFormat -and $Command -eq "convert") { $params += " -t $TargetFormat" } if ($Files.Count -gt 0) { $filesXml = Build-FilesXml -FilePaths $Files -FilePassword $Password $base64FilesXml = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($filesXml)) $params += " -f $base64FilesXml" } ``` ```powershell $params += " -wsclaw -autoexec -entrance $Entrance" ``` ### Technical Analysis `target_format` and `entrance` are inserted into a whitespace-delimited command string without valid ...[truncated 2405 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (29)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description claims a skill that executes many local PDF operations through PDFToolbox. However, this code chunk does not carry out conversion, OCR, optimization, translation, signing, merging, etc. Instead, it constructs a wspet:// URL containing encoded parameters and prints launch commands for URL, PowerShell, or CMD. While the supported command list references many PDF actions, the script merely prepares invocation parameters for an external application. That is a materially narrower behavior than the declared purpose of performing PDF operations. Additionally, the header comment specifically describes a Windows protocol launcher, so the declared cross-platform Windows/Linux support is not evidenced by this chunk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description says to use the skill when the user asks to 'convert, optimize, OCR, translate, secure, split, merge, watermark, extract, print, or otherwise batch-process PDF files.' The catch-all phrase 'otherwise batch-process PDF files' is broad and lacks explicit boundaries or negative examples, which can cause unintended invocation for general PDF-related conversation.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
Autonomous execution is present through the required '-autoexec' flag, which reduces the opportunity for the user to review parameters before the tool acts. Given this skill's broad PDF-manipulation scope, autonomous launches could perform sensitive local actions such as extraction, signing, printing, or security changes with minimal user awareness.
- Content
md - `-t <format>`: Target format for `convert`, such as `.docx`, `.xlsx`, `.pptx`, `.jpg`, `.png`, `.txt`, `.html`, `.xml`, `.epub`, or `.ofd`. - `-f <base64xml>`: Pre-load files and optional passwords using Base64-encoded UTF-8 XML. - `-wsclaw`: Mark the command as triggered by OpenClaw. Mandatory on Windows for every command. - `-autoexec`: Auto-execute after 10 seconds when files are loaded. Mandatory on Windows for every command. - `-hidden`: Run hidden when the workflow supports it (Linux only). - `/activateform`: Activate an existing instance without switching pages. - `/exit` or `/nowexit`: Close the running toolbox instance.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill mandates use of '-autoexec' and describes automatic execution after a countdown, but it does not consistently require an explicit warning or confirmation before actions modify files. In a document-processing context, that can lead to unintended conversions, OCR, watermarking, security changes, printing, or overwriting outputs based on a loosely matched user request.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the agent to reuse another active Linux desktop session by supplying DISPLAY, XAUTHORITY, and DBUS_SESSION_BUS_ADDRESS values. That crosses a session boundary and can let the agent inject GUI actions into a user's desktop context, potentially accessing files, dialogs, and trust associated with that session without proper re-authentication.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Repeated guidance to launch through the active desktop session using session-specific environment variables normalizes session hijacking as standard operation. In shared or managed systems, this could let an automated agent drive a GUI under a different user's authority and interact with documents or prompts the agent should not control.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The working rules operationalize reuse of a Linux user's active desktop session context, making unsafe cross-session execution part of the intended workflow. Because this skill opens document-processing GUIs, the context makes the issue more dangerous: injected actions may expose sensitive PDFs, overwrite outputs, or interact with signing/security workflows under the user's session.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest describes a local PDF operations skill, but this reference instructs users to fetch PDFelement from an external URL. Network access to download software is a separate capability from performing local PDF conversions and batch processing, and the manifest does not state any software acquisition or web-access role.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The
translatecommand is documented without requiring source/target language selection or clarifying locale constraints, which can cause silent misuse of a language-dependent feature on sensitive documents. In practice this can lead to incorrect translations, confidentiality issues if translation relies on online services, or unintended processing that the user did not meaningfully specify.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
The
-autoexeccapability enables autonomous execution of PDF operations after files are loaded, reducing meaningful user control over actions that can modify documents or create derived outputs. In an agent skill context, autonomy over local file operations is risky because mistaken file selection or prompt confusion can quickly propagate across batches.- Content
md --- #### `-autoexec` Auto-execute the operation after a 10-second countdown when files are loaded and the Apply button is available. **Version:** 12.1.14+
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
This example normalizes OCR auto-execution, encouraging unattended processing of loaded documents. That is dangerous because OCR may produce or overwrite outputs on sensitive files without a final user check, especially in bulk workflows.
- Content
Example 3: OCR with Auto-Execute (Windows - wspet://)
powershell $filesXml = @" <?xml version="1.0" encoding="UTF-8"?>
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The text explicitly states that OCR starts with an auto-execute countdown, reinforcing unattended execution behavior. In a skill environment, such framing makes it more likely integrators will adopt unsafe defaults that process documents without sufficient consent or verification.
- Content
$base64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($params)) Start-Process "wspet://param=$base64"
text Starts OCR with file pre-loaded and 10-second auto-execute countdown. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
This example promotes optimization/compression with auto-execution, which can alter output quality and generate changed files without explicit approval at run time. For a local document-processing skill, autonomous quality-affecting changes are a meaningful safety risk.
- Content
Example 4: Optimize with Auto-Execute (Windows - wspet://)
powershell $filesXml = @" <?xml version="1.0" encoding="UTF-8"?>
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 89% confidence
- Finding
The example description highlights that compression is performed with auto-execute enabled, again endorsing unattended action on user files. This increases the chance of accidental batch processing or undesired transformations when invoked by an agent.
- Content
$base64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($params)) Start-Process "wspet://param=$base64"
text Compresses PDF with auto-execute enabled. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
This example promotes translation with auto-execution, combining two risk factors: autonomous action and a language-sensitive operation. That can lead to unintended processing of sensitive PDFs and incorrect outputs without clear user validation.
- Content
Example 5: Translate with Auto-Execute (Windows - wspet://)
powershell $params = "translate -f $base64Files -wsclaw -autoexec -entrance OpenClaw" $base64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($params))
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The multiple-file conversion example uses auto-execute, which magnifies the impact of any incorrect file selection or prompt misunderstanding across a batch. Batch autonomy is especially risky because mistakes scale immediately to many documents.
- Content
$base64Param = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($params)) Start-Process "wspet://param=$base64Param"
text Converts three PDFs to PowerPoint format with files pre-loaded and auto-execute. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
This section explicitly teaches file pre-loading plus auto-execution over the custom protocol, making unattended local file actions a documented integration pattern. In agent contexts, that pattern materially increases the chance of unreviewed execution on user documents.
- Content
Example 9: wspet:// with File Pre-loading and Auto-Execute
PowerShell:
powershell
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The examples for different operations continue to endorse auto-execute, broadening the unsafe pattern across multiple commands. This is dangerous because it standardizes autonomous execution as a norm rather than an exception for local file manipulation.
- Content
Example 10: wspet:// for Different Operations
Optimize with auto-execute:
powershell $filesXml = @" <?xml version="1.0" encoding="UTF-8"?>
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 89% confidence
- Finding
The OCR example under the multi-operation section again instructs auto-execute usage, reinforcing unattended processing of possibly sensitive scans. Repetition of this pattern makes accidental unsafe adoption more likely.
- Content
Start-Process "wspet://param=$base64"
text **OCR with auto-execute:** ```powershell $params = "ocr -f $base64Files -wsclaw -autoexec -entrance OpenClaw" $base64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($params))
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 89% confidence
- Finding
The translate example similarly endorses auto-execution, which is especially problematic if translation uses remote services or ambiguous language defaults. It reduces user awareness and control for a potentially privacy-sensitive operation.
- Content
Start-Process "wspet://param=$base64"
text **Translate with auto-execute:** ```powershell $params = "translate -f $base64Files -wsclaw -autoexec -entrance OpenClaw" $base64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($params))
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document promotes
-autoexecworkflows that automatically perform file-processing after a short countdown, which can change files or generate outputs without an explicit per-operation confirmation in the skill flow. In a local file-processing skill, this increases the risk of unintended modifications, batch actions on the wrong inputs, or sensitive-document processing without adequate user review.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The launch templates repeatedly invoke PDF conversion, OCR, optimization, and similar workflows that can create new files or modify document state, but the guidance does not prominently warn about these side effects. In an agent skill context, operators may treat these as harmless open/view actions, increasing the risk of unintended file creation, overwrites, or processing of sensitive local documents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Translate PDF workflow suggests sending document contents through a translation feature without any privacy or data-handling warning. If the feature relies on cloud or third-party processing, sensitive document contents could be transmitted outside the local environment without informed consent, which is especially risky in an agent-driven batch-processing skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The diagnostic logging behavior records sensitive document metadata and can expose passwords indirectly through the later logged parameter string that includes the encoded file XML. Users are not warned that enabling diagnostics may persist secrets and private file locations to disk, increasing the chance of accidental disclosure to local users, support bundles, or backup systems.
- Content
Static analysis
No suspicious patterns detected.