Skills/ClawHub/minimax-pdf-pro

minimax-pdf-pro@1.0.0

BLOCKED· static only

Publisher claims: "Professional PDF solution. Create PDFs using HTML+Paged.js (academic papers, reports, documents). Process existing PDFs using Python (read, extract, merge, s..." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher luaqnyin · publishing for 230 daysInstalls 895Last detonated 13 min ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-15 and scored it 49/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Pipe-to-shell pattern; Privileged sudo command. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

CRITICAL
Pipe-to-shell patternscripts/setup.sh:452 · Pipe-to-shell pattern — downloads and immediately executes remote codeecho " Tectonic: curl -fsSL https://drop-sh.fullyjustified.net | sh"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Privileged sudo commandscripts/html_to_pdf.js:167 · Privileged sudo command — agent may execute with elevated privilegesconsole.error(' sudo apt-get install -y libgbm1 libasound2 libatk-bridge2.0-0 \\');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:50 · npx invocation of non-well-known package — may execute untrusted code2. 安装 Chromium：`npx playwright install chromium`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/browser_helper.js:81 · npx invocation of non-well-known package — may execute untrusted code' npm install -g playwright && npx playwright install chromium\n' +Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Rule modification attempthandlers/latex.md:103 · Rule modification attempt — overwriting existing instructions · informational: not an instruction file### Rule 2: Code Length Limit & Splitting StrategyFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionscripts/link_preserve.js:346 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` 输出文件: ${outputFile}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/html_to_pdf.js:106 · npx invocation of non-well-known package — may execute untrusted codeconsole.error(' Please run: npx playwright install chromium');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/setup.sh:361 · npx invocation of non-well-known package — may execute untrusted codeecho " Fix: npx playwright install chromium"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/html_to_pdf.js:124 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Converting ${path.basename(inputFile)}...`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/compile_latex.py:78 · Python subprocess execution detectedresult = subprocess.run(install_cmd, check=False, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/setup.sh:389 · npx invocation of non-well-known package — may execute untrusted codeecho " Fix: npx playwright install chromium"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/link_preserve.js:437 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` 输出HTML: ${outputFile}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/link_preserve.js:14 · File type combined with upload action — agent may exfiltrate local data files* node link_preserver.js restore translated.html links.json --output final.htmlFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/html_to_pdf.js:164 · npx invocation of non-well-known package — may execute untrusted codeconsole.error(' npx playwright install-deps chromium');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/link_preserve.js:472 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` 输出文件: ${outputFile}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Unpinned dependencyscripts/setup.sh:419 · Unpinned dependencyecho " npm install -g playwright@latest"Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
Python subprocess execution detectedscripts/cmd_convert.py:84 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Rule modification attempthandlers/latex.md:113 · Rule modification attempt — overwriting existing instructions · informational: not an instruction file### Rule 3: Required Packages & ConfigurationFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Remote installer piped to shellscripts/setup.sh:452 · Remote installer piped to shellecho " Tectonic: curl -fsSL https://drop-sh.fullyjustified.net | sh"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File type combined with upload actionscripts/html_to_pdf.js:636 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Path: ${outputPath}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/setup.sh:38 · npx invocation of non-well-known package — may execute untrusted code# Try npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/setup.sh:97 · npx invocation of non-well-known package — may execute untrusted codelocal output=$(npx playwright install chromium --dry-run 2>&1 || true)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Rule modification attempthandlers/latex.md:152 · Rule modification attempt — overwriting existing instructions · informational: not an instruction file### Rule 4: LaTeX Syntax StandardsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Rule modification attempthandlers/latex.md:87 · Rule modification attempt — overwriting existing instructions · informational: not an instruction file### Rule 1: Compilation Error Handling - Must Fully FixFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionscripts/link_preserve.js:390 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` 输出文件: ${outputFile}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/pdf.sh:58 · npx invocation of non-well-known package — may execute untrusted codeif ! npx playwright install chromium >/dev/null; thenFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/setup.sh:368 · npx invocation of non-well-known package — may execute untrusted codeecho " Fix: npm install -g playwright && npx playwright install chromium"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/compile_latex.py:207 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/html_to_pdf.js:631 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`File: ${path.basename(outputPath)}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/html_to_pdf.js:178 · npx invocation of non-well-known package — may execute untrusted codeconsole.error(' npx playwright install chromium');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandscripts/compile_latex.py:201 · File permission modification command — agent changes file ownership/permissionsprint(" chmod +x ~/tectonic")Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
Rule modification attempthandlers/latex.md:166 · Rule modification attempt — overwriting existing instructions · informational: not an instruction file### Rule 5: Multilingual & FontsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈2,805 tok
1 file · 29 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

31 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim luaqnyin: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim luaqnyinPropose a patch to the maintainer