ClawHub
Back to skill

Security audit

OpenDataLoader PDF Parser (乌贼版)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward PDF conversion helper, with ordinary local output and installation caveats rather than evidence of hidden or malicious behavior.

Install only from a package source you trust, consider pinning a reviewed version, and avoid converting sensitive PDFs into shared or world-readable output directories. Use stdout or sanitization options when appropriate.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: Unpinned dependency installation from a mutable package index
Risk Level: Medium

Vulnerable Code

bash
pipx install opendataloader-pdf

Technical Analysis

The installation instructions retrieve the latest available release of opendataloader-pdf without specifying an exact version or verifying an expected artifact hash. Consequently, installation results can change over time even though the reviewed skill files remain unchanged.

If the upstream project, maintainer account, publishing credentials, package index, or dependency chain is compromised, a malicious future release could be installed. Depending on the distributed artifact and packaging path, attacker-controlled code could run during package building, installation, or subsequent invocation of the installed command.

This finding does not establish that the current package is malicious. It identifies an avoidable supply-chain exposure caused by installing mutable, unverified content.

Attack Path

  1. An attacker compromises the package publisher, publishing credentials, upstream release process, or a transitive dependency.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the documented unpinned installation command.
  4. pipx resolves and installs the attacker-controlled release.
  5. Malicious code executes during an applicable build or installation stage, or when the user later runs opendataloader-pdf.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pipx or the installed CLI. This may expose files, environment variables, credentials, and network access available to that user. It does not directly provide elevated system privileges unless the installation or command is run by a privileged account or another privilege-escalation weakness e ...[truncated 6 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the package to a reviewed exact version, for example:

    bash
    pipx install "opendataloader-pdf==<reviewed-version>"

  • Publish and verify cryptographic hashes for approved release artifacts where the installation workflow supports hash verification.

  • Lock and audit transitive dependencies in a reproducible build process.

  • Prefer a trusted internal package mirror or approved artifact repository.

  • Monitor upstream releases and only update the pinned version after source, artifact, and dependency review.

  • Avoid running package installation or document conversion as root.

T09 · Insecure Skill Coding Practices

Note
Location
references/test_script.sh:14
Finding

Predictable Shared Temporary Output Directory

Content
View full analysis

Vulnerability Details

File Location: references/test_script.sh, lines 14–15
Vulnerability Type: Unsafe use of a predictable directory under a shared temporary path
Risk Level: Low

Vulnerable Code

bash
OUTPUT_DIR="/tmp/pdf_test_output"
mkdir -p "$OUTPUT_DIR"

The directory is subsequently used for generated output:

bash
opendataloader-pdf "$PDF_PATH" -o "$OUTPUT_DIR" -f markdown --to-stdout 2>/dev/null | head -20
opendataloader-pdf "$PDF_PATH" -o "$OUTPUT_DIR" -f json 2>/dev/null
opendataloader-pdf "$PDF_PATH" -o "$OUTPUT_DIR" -f markdown --pages "1-3" 2>/dev/null

Technical Analysis

The script uses a constant path in the globally shared /tmp namespace. mkdir -p does not establish that an existing path was created by the current user, has safe ownership and permissions, or is not an attacker-prepared directory. Concurrent executions also share the same output location.

A local attacker who can create /tmp/pdf_test_output before the script runs may control its permissions and contents. Generated document output could therefore be exposed, modified, or disrupted. If the downstream converter follows attacker-created symbolic links while writing output files, targeted file replacement may also be possible, subject to the converter's file-opening behavior and the victim user's permissions.

Attack Path

  1. A local attacker anticipates execution of the test script.
  2. The attacker creates /tmp/pdf_test_output first and populates it with selected files or symbolic links.
  3. A victim runs the script with a PDF while using the same predictable path.
  4. mkdir -p accepts the existing directory without validating its owner, mode, or contents.
  5. The converter writes generated output into the attacker-prepared location.
  6. The attacker may read or tamper with output. If symbolic links are followed by the converter, writes may be redirected to another file writabl ...[truncated 433 chars]
Remediation
View remediation

Remediation Suggestions

  • Create a unique private temporary directory with mktemp -d:

    bash
    umask 077
OUTPUT_DIR="$(mktemp -d "${TMPDIR:-/tmp}/pdf_test_output.XXXXXX")" || exit 1
trap 'rm -rf -- "$OUTPUT_DIR"' EXIT

  • Keep the directory quoted in all command invocations.

  • Do not reuse a fixed temporary directory across users or concurrent executions.

  • If persistent output is required, require an explicit caller-controlled path and validate its ownership and permissions before writing.

  • Configure restrictive permissions and reject symbolic links or unexpected pre-existing output files where supported.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The markdown shows repeated examples using -o output_dir and --image-dir images/, which create output files and directories containing document contents, but it does not explicitly warn users that parsed data will be written to disk unless --to-stdout is used. Because this behavior may expose sensitive document contents on the local filesystem, a brief disclosure would improve user awareness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.