PDF to Markdown
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's functionality and instructions mostly align with its description, but the runtime instructions recommend downloading and piping a remote install script (curl | bash) which is a high-risk install pattern and therefore warrants caution.
The skill appears to do what it says (local PDF → Markdown/JSON/HTML). However, be cautious before running the recommended install script: piping a script downloaded from the web into bash can run arbitrary code on your machine. Prefer safer alternatives: (1) inspect the contents of the install.sh on the GitHub repo before running it, (2) use 'pip install opendataloader-pdf' or install from a trusted package source when possible, (3) run installation steps in an isolated environment (container or VM) to limit blast radius, (4) avoid creating or overwriting system-level binaries; double-check the symlink target and ensure it won't unintentionally shadow system Java, and (5) verify the upstream repository (opendataloader-project/opendataloader-pdf) and package integrity (checksums, release tags, maintainer reputation) before trusting automated install instructions.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.