Security audit
Security checks for vulnerabilities and agentic risk
This skill generates local PDF files from user-provided structured data, with no evidence of hidden access, persistence, exfiltration, or unsafe install behavior.
Before installing, consider that the helper script writes to the output path you provide and may embed local images from paths in your JSON. Review generated PDFs for language labels if you need non-German metadata text.
The manifest description says to use the skill when a user wants to "create, export, or save content as a PDF file," which is broad enough to overlap with common requests and does not define exclusions or tighter scope boundaries. Although several specific trigger phrases are listed, the surrounding activation condition remains ambiguous about when this skill should or should not be invoked.
The generated PDF metadata line uses the hard-coded labels "Autor" and "Datum", which forces German output regardless of user preference. This is a natural-language locale policy issue because the file provides no opt-in, fallback, or documentation that the skill is intentionally German-only.
The trigger list includes German phrases alongside English ones, but the file does not explain whether multilingual triggering is optional, user-selected, or constrained to a specific locale. This can create a language-policy issue because the skill embeds locale-specific activation behavior without documenting user choice or justification.
This markdown file includes a full example whose title, headings, and list items are written in German, but it does not indicate that the language is optional or region-specific. Under the policy, natural-language instructions or examples that effectively impose a specific language without user opt-in should be flagged.
No suspicious patterns detected.
