ClawHub
Back to skill

Security audit

Llamaparse

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims by using LlamaCloud to parse documents, but it deserves review because it can send sensitive files and local path metadata to a cloud service and has under-scoped screenshot downloads.

Review before installing if you may parse confidential, regulated, customer, legal, financial, or proprietary documents. Treat every parsed file as uploaded to LlamaCloud, avoid batch folders with sensitive path names, and avoid --save-screenshots unless you trust the provider response path and can tolerate extra network downloads.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Note
Location
scripts/batch_parse.py:38
Finding

Unnecessary Disclosure of Local File Paths to an External Service

Content
View full analysis

Vulnerability Details

File Location: scripts/batch_parse.py, lines 38–42
Vulnerability Type: Sensitive local metadata disclosure
Risk Level: Low

python
file_obj = await client.files.create(
    file=str(file_path),
    purpose="parse",
    external_file_id=str(file_path),
)

Technical Analysis

The batch parser transmits the complete local file path as the remote external_file_id. Although uploading the document is intrinsic to the Skill's declared functionality, disclosing the local path is not necessary for parsing.

Local paths can contain sensitive contextual information such as operating-system usernames, customer names, internal project identifiers, case names, or confidential directory structures. This metadata is disclosed in addition to the document content and may be retained or logged by the external API as an identifier.

Attack Path

  1. A user stores a document at a path containing sensitive information, such as /home/alice/clients/acme-merger/forecast.pdf.
  2. The user invokes batch_parse.py on the containing directory.
  3. The script uploads the document and assigns the full local path to external_file_id.
  4. The LlamaParse service receives the workstation path as remote request metadata.
  5. Anyone with appropriate access to the service's request records or file metadata may learn details about the user's local environment and confidential project context.

This issue does not grant local code execution, elevated privileges, or additional filesystem access. Exploitation is limited to metadata disclosed during an otherwise authorized upload.

Impact Assessment

The primary impact is loss of privacy and unnecessary disclosure of local environment information to a third-party service. The exposed scope is limited to paths of files intentionally selected for batch processing. No operating-system privileges are obtained, and the code does not disclose unrelated file ...[truncated 24 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove external_file_id when it is not required by the parsing workflow.
  • If a tracking identifier is needed, use a randomly generated opaque identifier such as a UUID.
  • If deterministic correlation is required, derive an identifier from a sanitized filename or an application-local mapping rather than the absolute path.
  • Do not include parent directory names, usernames, drive names, or network-share locations in remote metadata.
  • Clearly disclose any optional path-metadata transmission and require explicit user consent before enabling it.
  • Add a regression test that mocks client.files.create() and verifies that neither absolute nor relative local paths are supplied as external_file_id.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/parse_document.py:141
Finding

Unrestricted Retrieval of API-Provided Screenshot URLs

Content
View full analysis

Vulnerability Details

File Location: scripts/parse_document.py, lines 141–145
Vulnerability Type: Server-side request forgery–like client behavior and unbounded download
Risk Level: Medium

python
async with httpx.AsyncClient() as http:
    for img in result.images_content_metadata.images:
        if img.presigned_url and re.match(r"^page_\d+\.jpg$", img.filename):
            resp = await http.get(img.presigned_url)
            (screenshots_dir / img.filename).write_bytes(resp.content)

Technical Analysis

The screenshot filename is constrained by a regular expression, which mitigates filename-based path traversal. However, img.presigned_url is trusted without validating its scheme, hostname, port, resolved address, or redirect destination.

Because the URL originates in an external API response, a compromised service, SDK, account, or response channel could cause the client to issue a request to an unintended destination. Potential targets include loopback services, private-network endpoints, or cloud metadata services. Redirects may also move an initially approved request to an unapproved host unless they are explicitly controlled.

The request additionally lacks an explicit timeout, response status validation, content-type verification, streaming, and a maximum response-size limit. resp.content buffers the entire body in memory before writing it, allowing an oversized response to consume substantial memory and disk space.

Attack Path

  1. The user runs parse_document.py with --save-screenshots.
  2. The script requests images_content_metadata from LlamaParse.
  3. A compromised or manipulated API response supplies a valid-looking filename such as page_1.jpg and an attacker-selected presigned_url.
  4. The script performs an HTTP request to that URL without checking whether it points to an approved HTTPS host or a private address.
  5. The attacker can induce the machine to contact ...[truncated 918 chars]
Remediation
View remediation

Remediation Suggestions

  • Parse each URL before use and require the https scheme.
  • Maintain an explicit allowlist of documented LlamaIndex or approved object-storage hostnames.
  • Resolve the hostname and reject loopback, link-local, private, multicast, reserved, and unspecified IP address ranges.
  • Disable redirects or validate every redirect target against the same scheme, host, and address policy.
  • Configure strict connection, read, write, and pool timeouts.
  • Call raise_for_status() before accepting the body.
  • Verify that the response content type is an expected image type.
  • Stream the response to disk in bounded chunks rather than accessing resp.content.
  • Enforce a conservative maximum download size using Content-Length when available and a running byte counter while streaming.
  • Delete partial files if validation or download fails.
  • Update the documentation so its network-scope statement accurately describes approved presigned storage domains.
  • Add tests covering private-address URLs, non-HTTPS URLs, redirects to private hosts, oversized responses, error status codes, and invalid content types.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill performs sensitive operations including reading an API key from the environment, uploading user documents to an external cloud service, and writing files, yet it declares no explicit tool scope or allowed-tools boundary. That makes the skill harder to govern and increases the chance it will be invoked with broader capabilities than intended, especially since it handles potentially sensitive document contents and network egress.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are very broad, including generic requests like parsing PDFs, extracting text, OCR, and document conversion, which can cause the skill to activate for many ordinary document tasks. Because this skill sends documents to an external service, over-broad routing increases the risk of unintentional data exfiltration or use on sensitive files when a narrower or local-only tool would have been more appropriate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The example explicitly uploads a local document to a third-party cloud parsing service but does not warn that document contents leave the local environment. In a document-processing skill, users may reasonably supply sensitive files, so omission of any privacy/data-handling notice can lead to unintended disclosure of confidential information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The cURL examples show direct transmission of files and parse requests to an external API endpoint without any disclosure that document data is sent off-host. Because this skill is specifically for parsing user-supplied documents, the missing warning increases the risk of accidental exfiltration of sensitive files.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This command performs external transmission of a local file to a remote API for parsing. While expected for this integration, it is still security-relevant because users may not realize that private document contents are being uploaded to a third party.

Content

Scanner excerpt · references/api-reference.md (reported line 127)May include surrounding context.

bash
# Upload file
curl -X POST 'https://api.cloud.llamaindex.ai/api/v2/files' \
  -H "Authorization: Bearer $LLAMA_CLOUD_API_KEY" \
  -F 'file=@document.pdf' \
  -F 'purpose=parse'

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This command performs external transmission of a local file to a remote API for parsing. While expected for this integration, it is still security-relevant because users may not realize that private document contents are being uploaded to a third party.

Content

Scanner excerpt · references/api-reference.md (reported line 127)May include surrounding context.

bash
# Upload file
curl -X POST 'https://api.cloud.llamaindex.ai/api/v2/files' \
  -H "Authorization: Bearer $LLAMA_CLOUD_API_KEY" \
  -F 'file=@document.pdf' \
  -F 'purpose=parse'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 133)May include surrounding context.

md
-F 'purpose=parse'

# Parse
curl -X POST 'https://api.cloud.llamaindex.ai/api/v2/parse' \
  -H "Authorization: Bearer $LLAMA_CLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code uploads every matching local document to the external LlamaCloud service via client.files.create(...), but the script provides no user-facing warning, confirmation, or consent flow about network transmission of potentially sensitive file contents. In a document-parsing skill, users may reasonably supply PDFs, scans, spreadsheets, or business documents that contain confidential or regulated data, so silent exfiltration to a third-party API increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script uploads the user-supplied document to the external LlamaCloud service via client.files.create(...) and parses it remotely, but it does not provide an explicit warning or consent prompt at the point of use. This is dangerous because users may unintentionally send sensitive, regulated, or proprietary document contents to a third party, creating privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.