Pdf Extract

Security checks across static analysis, malware telemetry, and agentic risk

Overview

This is a simple, coherent PDF-to-text helper using pdftotext; users should mainly notice the manual system package install and that extracted PDF contents may enter LLM context.

This skill appears safe and narrowly scoped for extracting text from PDFs. Before installing, make sure you trust the poppler-utils package source, and only process PDFs whose contents you are comfortable letting the agent/model read.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI06: Memory and Context Poisoning
Low
What this means

Text from PDFs you process may become part of the agent/model context.

Why it was flagged

The skill intentionally turns PDF contents into text for model use. This is expected for the skill, but PDF text may contain sensitive information or embedded instructions that should not automatically be trusted as agent instructions.

Skill content
Extract text from PDF files for LLM processing. Uses `pdftotext` ... to convert PDF documents into plain text.
Recommendation

Use it on documents you intend to share with the agent, and treat extracted document text as untrusted content rather than commands.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

Installing the dependency changes your local environment like any other system package installation.

Why it was flagged

The setup step installs an OS package to provide pdftotext. This is purpose-aligned and user-directed, but it modifies the local system and depends on the configured package repository.

Skill content
sudo dnf install poppler-utils
Recommendation

Install poppler-utils only from trusted OS repositories and confirm it is the expected package for your platform.