Remove metadata from PDF

Remove metadata from one or multiple PDFs by uploading them to the Solutions API, polling until completion, then returning download URL(s) for the cleaned PDF(s) (or a ZIP if multiple).

Security Scan

The skill appears to do what it says (upload PDFs to a third‑party Solutions API and return cleaned file URLs), but there are coherence issues around declared credentials and registry metadata that you should confirm before installing or using it with sensitive documents.

Purpose & Capability

The skill's stated purpose (remove PDF metadata via the Solutions API) matches the included script and SKILL.md. However, the registry metadata lists no required environment variables or primary credential while the SKILL.md and script both require an API key (SOLUTIONS_API_KEY or --api-key). That mismatch between what the package declares and what it actually needs is an inconsistency worth noting.

Instruction Scope

Runtime instructions are narrowly scoped: accept PDF files, upload them to the specified Solutions API endpoint, poll job status, and return output URLs. Allowed tools are limited to http and files. The instructions do not request unrelated files, system credentials, or broad system access.

Install Mechanism

There is no install script or remote download; the package is instruction + included script. requirements.txt only lists the requests library. No external arbitrary downloads or extraction steps are present.

Credentials

The skill legitimately needs a third‑party API key (used as a Bearer token) and optionally a base URL. Those are present in SKILL.md and the script, but the registry's required-env fields do not declare them. The requested credential is proportional to the task, but the missing declaration is an inconsistency that could cause surprise and should be clarified.

Persistence & Privilege

The skill does not request always:true or any persistent/system-wide privileges, does not alter other skills' configs, and does not request unusual config paths. Autonomous invocation remains allowed (platform default).

What to consider before installing

Before installing or using this skill: (1) Understand that your PDF files will be uploaded to https://api.xss-cross-service-solutions.com (or a base URL you provide) — do not send sensitive documents unless you trust that service and its privacy policy. (2) The skill requires a Solutions API key (SOLUTIONS_API_KEY or --api-key), but the registry metadata does not declare this — confirm where/how you'll provide the key. (3) The included script is readable (no obfuscated code) and uses only the requests library, but validate the exact API hostname and endpoints (look for typos or phishing domains) and prefer testing with non-sensitive PDFs first. (4) If you need to avoid third‑party uploads, consider running the included script locally against a trusted or self-hosted endpoint or request a version that runs metadata removal entirely client-side.

Purpose

This skill removes metadata from one or multiple PDFs by:

1. accepting one or multiple PDF files from the user,
2. uploading them to the Solutions API,
3. polling the job status until it is finished,
4. returning download URL(s) for the cleaned file(s). If multiple PDFs are processed, the output may include multiple PDFs and/or a ZIP for download.

Credentials

The API requires an API key used as a Bearer token:

• Authorization: Bearer <API_KEY>

How the user gets an API key:

• https://login.cross-service-solutions.com/register
• Or the user can provide an API key directly.

Rule: never echo or log the API key.

API endpoints

Base URL:

• https://api.xss-cross-service-solutions.com/solutions/solutions

Create job:

• POST /api/40
• multipart/form-data parameters:
  • files — required — multiple PDF files (multiple_files)

Get result by ID:

• GET /api/<ID>

When done, the response contains:

• output.files[] with { name, path } where path is a downloadable URL (PDFs and/or ZIP).

Inputs

Required

• One or more PDF files (binary)
• API key (string)

Optional

• None

Output

Return a structured result:

• job_id (number)
• status (string)
• outputs (array) containing { name, path } for each output file
• Convenience fields:
  • download_url (string) if exactly one output exists
  • download_urls (array of strings) for all outputs
• input_files (array of strings)

Example output:

{
  "job_id": 990,
  "status": "done",
  "outputs": [
    { "name": "cleaned.pdf", "path": "https://.../cleaned.pdf" }
  ],
  "download_url": "https://.../cleaned.pdf",
  "download_urls": ["https://.../cleaned.pdf"],
  "input_files": ["input.pdf"]
}