ai-pdf-builder
Verdict safe, but 2 findings (2 medium), mainly unauthorized tool use, social engineering. Most recent scan 2026-02-05.
The ai-pdf-builder skill presents MEDIUM security risk due to missing implementation code, unclear tool permissions, and API key handling concerns. While the skill's stated purpose (PDF generation from Markdown with AI assistance) is legitimate, the absence of actual implementation files prevents verification of security claims like 'content sanitization' and secure API usage. The skill requires significant external dependencies (Pandoc, LaTeX, NPM packages, Anthropic API) but lacks explicit allowed-tools declarations, creating permission ambiguity. The documentation instructs users to expose their Anthropic API keys via environment variables without security warnings. Most concerning is that all referenced Python implementation files are missing, making it impossible to audit actual behavior, data flows, or verify that the skill matches its description. The skill should not be used until complete implementation code is provided for security review.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Generate professional PDFs from Markdown using Pandoc and LaTeX with AI-powered content generation. Creates whitepapers, term sheets, memos, agreements, SAFEs, NDAs, and more.
- Package
- 2 files, 6.0 KB
- SKILL.md
- 744 words, 12+ sections
- Code
- None. Instructions only.
- Version
- 1.1.0
SKILL.md covers: AI PDF Builder · What's New in v1.1.0 · Requirements · macOS · Linux · Usage · Check System · Generate via CLI · From markdown file · With company name · Document types: whitepaper, memo, agreement, termsheet, safe, nda, report, proposal · AI Content Generation (New!)
Findings
MEDIUM Missing allowed-tools Declaration with External Tool Dependencies Unauthorized Tool Usellm
The skill requires external system tools (pandoc, basictex/texlive, tlmgr, npm/npx) and makes network calls (npx downloads packages, AI API calls to Anthropic), but does not declare any allowed-tools restrictions in the manifest. While allowed-tools is optional, the absence of this field combined with significant external dependencies and network activity creates ambiguity about the skill's intended permissions and makes it harder for users to assess security boundaries.
SKILL.md
YAML Manifest shows:
- allowed-tools: Not specified
But instructions require:
- System package installation (brew, apt-get, tlmgr)
- Network package execution (npx)
- External API calls (Anthropic API)
- File system operations (reading/writing PDFs and markdown)MEDIUM Missing Implementation Code Creates Verification Gap Social Engineeringllm
The skill claims to provide AI-powered PDF generation with multiple document types and AI features (generate, enhance, summarize), but no actual implementation code (Python/Bash scripts or JavaScript/TypeScript) is provided in the package. All referenced Python files (content.py, prompt.py, documents.py, etc.) are missing. This creates a significant verification gap where the actual behavior, security controls, data handling, and API usage cannot be audited. Users cannot verify claims about content sanitization, AI integration security, or data flow.
Referenced Files show 7 Python files mentioned but all marked as 'not found':
- content.py (not found)
- their.py (not found)
- prompt.py (not found)
- prompts.py (not found)
- documents.py (not found)
- Markdown.py (not found)
- a.py (not found)
No script files provided despite claims of AI content generation, enhancement, and summarization features.What is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 510 B |
SKILL.md | doc | 5.5 KB |
External hosts referenced
github.com www.npmjs.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/ai-pdf-builder
- Raw scan result: ai-pdf-builder-scan.json
- Badge for your README:
- Request a re-scan