ODL PDF to Markdown
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's instructions generally match its stated purpose (PDF -> Markdown) but the runtime instructions request system-level dependencies and an unattended remote install (curl | bash) while the registry metadata omits required binaries — this mismatch and the install pattern warrant caution.
This skill appears to do what it says (convert PDFs using OpenDataLoader) but take precautions before installing: - Verify upstream: inspect https://github.com/opendataloader-project/opendataloader-pdf and confirm the install.sh contents before running it. Do not run curl | bash without reviewing the script. - Prefer safer installs: use pip inside a virtualenv or container (python -m venv) instead of global pip, and install Java and Tesseract from your OS package manager rather than symlinking arbitrary java binaries. - The registry metadata omitted required binaries (Java, Python, Tesseract). Make sure your environment has Java 11+ and Python 3.10+ before invoking the skill. - Run the installer in an isolated environment (container or VM) if you want to limit blast radius. - Check licenses and the project's repository activity (stars, maintainers, recent commits) to ensure the upstream project is legitimate. If you are uncomfortable reviewing remote install scripts or modifying your system PATH, install and run OpenDataLoader manually in a sandboxed environment before enabling this skill.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.