ClawHub
Back to skill

Security audit

pdf-analysis

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent PDF-analysis integration that discloses local text extraction, API-key use, and sending extracted PDF text to the configured analysis platform.

Install only if you are comfortable sending extracted PDF text to the AI Skills platform under your API key. Avoid using it on contracts, financial records, or personal data unless you have authorization, and delete temporary extraction JSON files after use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill appears capable of writing files (for example, exporting analysis results) but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap: an agent/runtime may grant broader file-write capability than users expect, increasing the risk of unintended overwrites, persistence of sensitive PDF-derived content, or writes to unsafe locations if downstream instructions are abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file shows sending a locally generated document object to a remote API endpoint and includes an Authorization header built from API keys. The example does not explicitly warn users that local content and credentials are being sent off-machine, which is the kind of privacy and system-impact behavior that markdown guidance should disclose.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/HTTP-REQUESTS.md (reported line 6)May include surrounding context.

下面以分析接口为例。把本地脚本生成的 document 对象放入请求体：

sh
curl -sS -X POST "${AI_SKILLS_API_URL:-https://ai-skills.open-idea.net}/api/v1/pdf-analysis/pdf.analyze" \
  -H "Authorization: Bearer ${PDF_ANALYSIS_API_KEY:-$AI_SKILLS_API_KEY}" \
  -H "Idempotency-Key: $(python3 -c 'import uuid; print(uuid.uuid4())')" \
  -H "Content-Type: application/json" \

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire operational documentation is presented only in Chinese, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. Under SQP-3, natural-language policy violations include forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file documents pdf.export as generating Markdown and JSON private files, but it does not include any warning about the fact that the operation writes output files or persists analysis results. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or system integrity, and file creation is such a behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code emits all error and guidance messages in Chinese, including dependency, validation, and file-processing failures. For a general-purpose extraction script, forcing a specific language without offering a choice or documenting a region-specific scope is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.