Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward PDF text extraction skill with disclosed terminal/file output and no evidence of hidden access, persistence, or exfiltration.
Before installing, treat extracted PDF text as potentially sensitive: avoid sending confidential documents to terminal logs or shared output paths, and verify the output filename because it will be overwritten if chosen.
The skill describes extracting PDF text and optionally writing it to an output file, but it does not warn users that PDFs often contain sensitive or regulated information and that extracted text may be exposed in terminal history, logs, or saved to disk. This omission can lead to accidental disclosure, especially when users process confidential documents in shared or monitored environments.
The module docstring and CLI description emphasize extracting plain text from PDF files, which suggests a conversion/extraction behavior. However, the implementation also performs filesystem write operations when --output is provided, creating a side effect not reflected in the top-level documentation.
No suspicious patterns detected.
