Convert to PDF

Convert one or multiple documents to PDF by uploading them to Cross-Service-Solutions, polling until completion, then returning download URL(s) for the converted PDF(s) (or a ZIP if multiple).

Security Scan

The skill's code and SKILL.md coherently implement a file-upload-to-third-party conversion flow, but the package metadata omits the required API credential and the provider/host are unverified — this mismatch and the need to upload user files to an external service warrant caution.

Purpose & Capability

Name/description match the code: the script uploads files to a 'Solutions' API, polls for completion, and returns download URLs. However, the registry metadata declares no required environment variables or primary credential while the SKILL.md and script clearly require an API key (SOLUTIONS_API_KEY or --api-key). That omission is an incoherence: a convert-to-pdf skill legitimately needs the service API key but the metadata doesn't advertise it.

Instruction Scope

SKILL.md and the script stay within the stated purpose: they request files from the user, upload them to the external API, poll job status, and return output URLs. The instructions explicitly require an API key and explicitly state not to echo it. The skill will transmit user files to a third party (the Solutions API), which is expected behavior for this functionality but is an important privacy consideration.

Install Mechanism

There is no install spec (instruction-only skill), so nothing arbitrary is downloaded or installed by an installer. A Python script is included in the bundle (requests dependency), which is normal for a CLI-style helper. Risk is limited to executing included code; no remote install of unknown binaries is present.

Credentials

The SKILL.md and script require an API key (SOLUTIONS_API_KEY or --api-key) and accept a base URL override, but the registry metadata lists no required env vars or primary credential. Asking for an API key is proportionate to the described purpose, but the metadata omission is misleading and increases risk (users may not realize they must provide a secret). The skill will transmit user files and the API key (as a Bearer token) to the configured host; ensure the key is not reused across unrelated services.

Persistence & Privilege

The skill does not request 'always: true' and does not modify other skills or global agent settings. It runs on invocation and does not demand persistent elevated privileges.

What to consider before installing

Before installing: (1) Understand that this skill uploads your files to a third-party service (https://api.xss-cross-service-solutions.com); do not send sensitive documents unless you trust the provider and have reviewed their privacy/TOS. (2) The skill requires an API key but the registry metadata fails to declare it — expect to provide SOLUTIONS_API_KEY or pass --api-key. (3) Verify the service hostname and owner; the package has no homepage and an unfamiliar owner ID, so confirm the provider is legitimate (the 'xss' substring in the domain is unusual and worth verifying). (4) Test with non-sensitive files first and consider creating a throwaway API key scoped only for this purpose. (5) If you will run the included Python script, inspect it (it's small and readable) and run it in a sandbox or isolated environment; note it sends files and a Bearer token to the configured base URL. (6) If you need the skill to be auditable, ask the publisher to update registry metadata to declare the required env var and to provide a homepage or official docs/terms. If you cannot verify the provider or are uncomfortable uploading files, do not install/use the skill.

Purpose

This skill converts one or multiple documents to PDF by:

1. accepting one or multiple input files from the user,
2. uploading them to the Solutions API convert endpoint,
3. polling the job status until it is finished,
4. returning download URL(s) for the resulting file(s). If multiple files are converted, the output may contain multiple PDFs and/or a ZIP for download.

Credentials

The API requires an API key used as a Bearer token:

• Authorization: Bearer <API_KEY>

How the user gets an API key:

• https://login.cross-service-solutions.com/register
• Or the user can provide an API key directly.

Rule: never echo or log the API key.

API endpoints

Base URL:

• https://api.xss-cross-service-solutions.com/solutions/solutions

Create convert job:

• POST /api/31
• multipart/form-data parameters:
  • files (Dokument) — required — multiple files (multiple_files)
    • You can convert multiple files and different types into multiple PDFs.
    • Multiple files can be downloadable as a zip-file.

Get result by ID:

• GET /api/<ID>

When done, the response contains:

• output.files[] with { name, path } where path is a downloadable URL (PDFs and/or ZIP).

Inputs

Required

• One or more input files (binary)
• An API key (string)

Optional

• None

Output

Return a structured result:

• job_id (number)
• status (string)
• outputs (array) containing { name, path } for each output file
• Convenience fields:
  • download_url (string) if exactly one output exists
  • download_urls (array of strings) for all outputs
• input_files (array of strings)

Example output:

{
  "job_id": 789,
  "status": "done",
  "outputs": [
    { "name": "file1.pdf", "path": "https://.../file1.pdf" },
    { "name": "file2.pdf", "path": "https://.../file2.pdf" },
    { "name": "converted.zip", "path": "https://.../converted.zip" }
  ],
  "download_urls": [
    "https://.../file1.pdf",
    "https://.../file2.pdf",
    "https://.../converted.zip"
  ],
  "input_files": ["file1.docx", "file2.pptx"]
}