UA1 Validator Agent

Validate PDFs against PDF/UA-1 using ua1.dev or api.ua1.dev from AI coding agents (OpenClaw, Claude Code, Codex, OpenCode). Use when an agent needs determini...

This skill is coherent and implements remote PDF/UA-1 validation by uploading files to api.ua1.dev. Before installing or using it, consider: 1) Data sensitivity — the script will POST the entire PDF to an external service; do not use it with private or regulated documents unless you trust api.ua1.dev and its privacy policy. 2) Runtime dependencies — ensure curl (and mktemp) exist on the runner; jq is used to parse the verdict but is optional (the script handles jq failure gracefully). 3) You can override UA1_API_BASE to point to a trusted/self-hosted endpoint if you have one. 4) The script returns exit codes (0=pass, 2=fail, 1=transport/error) — use these in CI gates as documented. 5) Verify the service’s authenticity (TLS certificate, domain ownership) before sending sensitive files. If you need local-only validation for privacy/compliance, prefer a local validator rather than this remote API.

Type: OpenClaw Skill Name: ua1-validator-agent Version: 0.1.0 The skill executes a bash script (`scripts/validate_pdf.sh`) with a user-provided file path. While the script includes a file existence check and uses `curl -F "file=@${FILE_PATH}"` (which is generally robust against shell injection within the filename itself), the direct execution of a shell script with an unsanitized argument from the agent's perspective poses a potential shell injection vulnerability. If the OpenClaw agent does not properly quote or sanitize the `FILE_PATH` argument before invoking the script, an attacker could inject arbitrary commands. This is a vulnerability that allows attacks, not intentional malice.