pdf-nano

• Analyzed: May 4, 2026, 2:41 PM
• Findings: 1
• Version: 1.0.0
• Hash: 8b872791e32ef4e495ea2d850445e1787365ef96a81da3cb9bfef3f00b0da873
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides comprehensive PDF processing capabilities, but includes scripts that perform high-risk system modifications. Specifically, `fill_pdf_form_with_annotations.py` contains logic to identify and write to system font directories (including `/usr/share/fonts` and `~/.local/share/fonts`) and executes the system utility `fc-cache` via `subprocess.run`. While these actions are documented in `forms.md` as 'environment-maintenance' for consistent text rendering, the automated copying of workspace assets into system paths and the execution of system binaries constitute a significant attack surface for environment manipulation.