Pdf Toolkit

PDF工具箱 - 合并、拆分、压缩、转换PDF文件。支持批量处理，无需联网，本地执行。

This package mostly does what it says: local PDF operations using Ghostscript, poppler, ImageMagick, etc. Before installing or running it: - Verify missing files: SKILL.md mentions watermark.js, encrypt.js and decrypt.js but those scripts are not present — confirm whether those features are required and why they are missing. - Review the included scripts locally (they are small) before running. They invoke system commands with execSync and interpolate file paths into shell commands; filenames containing special characters could be misinterpreted and allow command injection. Avoid running these scripts on untrusted input or with untrusted filenames. - Be cautious about the recommended change to /etc/ImageMagick-6/policy.xml — that weakens ImageMagick protections for PDF handling and requires root. Understand the security tradeoff and prefer safer alternatives when possible. - Confirm and install the required system binaries (poppler-utils, ghostscript, ImageMagick, pdftk, img2pdf) from trustworthy package sources. - Prefer running the tools in a sandbox or non-privileged account and test on copies of sensitive files first. If you plan to run programmatically, consider wrapping calls to external binaries with safer APIs (execFile with args array) or sanitizing/validating all file paths. If you need certainty about absent features or want the watermark/encrypt capabilities, ask the publisher for a complete release or provide the missing scripts before trusting this skill on sensitive documents.

Type: OpenClaw Skill Name: openclaw-pdf-tools Version: 1.0.0 The skill bundle provides PDF processing utilities but contains multiple shell injection vulnerabilities across its scripts (e.g., compress.js, merge.js, split.js, and extract-text.js). It uses child_process.execSync to execute system commands like gs, pdftotext, and pdftk without properly sanitizing file paths or user-provided arguments, which could allow for arbitrary command execution if filenames contain shell metacharacters.