PDF to Markdown
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's purpose (PDF → Markdown/JSON/HTML) is coherent, but the runtime instructions recommend executing a remote install script (curl | bash) and include a few installation/information gaps (Tesseract not described, symlink into ~/.local/bin) that increase risk and deserve review before installing.
This skill appears to do what it claims (local PDF parsing) but the install instructions recommend running a remote install script (curl | bash) and include a symlink command that could overwrite files in ~/.local/bin. Before installing: (1) review the install.sh contents on the upstream GitHub repo instead of piping it directly to bash, (2) prefer installing Java/Tesseract from your OS/package manager (apt/homebrew/choco) and install opendataloader-pdf via pip manually, (3) verify that Tesseract and language packs are installed if you need OCR, and (4) consider testing in an isolated environment (VM or container) if you cannot fully review the upstream scripts.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.