Security audit
Security checks for vulnerabilities and agentic risk
This PDF tool appears locally focused, but it materially overstates features such as PDF-to-image conversion and batch processing.
Review this carefully before installing. It appears to be a local PDF utility rather than malware, but do not rely on the advertised image conversion or batch features without testing them first, and run it only on copies of important PDFs in a dedicated output folder.
The documentation claims PDF-to-image conversion and broad batch processing, but the static findings indicate the code does not actually emit images and may only perform page-splitting behavior while ignoring format/DPI options. Such description-behavior mismatch can mislead users into running document workflows under false assumptions, potentially causing data handling errors or loss of expected outputs.
The documentation claims PDF-to-image conversion and broad batch processing, but the static findings indicate the code does not actually emit images and may only perform page-splitting behavior while ignoring format/DPI options. Such description-behavior mismatch can mislead users into running document workflows under false assumptions, potentially causing data handling errors or loss of expected outputs.
Referenced artifact was not completely inspected
node scripts/split.js input.pdf -p 1-5 -o output/
Referenced artifact was not completely inspected
node scripts/to-image.js input.pdf -o output/images/
The visible user-facing description and instructions are presented in Chinese, and the file does not offer an alternative language or explain that the skill is intended only for a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
This markdown file describes merging, splitting, compressing, converting, and batch-processing PDFs, all of which can create or overwrite output files and affect user data. The description provides usage examples but does not include any caution about reviewing inputs/outputs, avoiding overwrites, or verifying batch operations before running them.
The user-facing description and CLI help strings are entirely in Chinese, which effectively forces a specific language for interaction. Under the policy, locale or language constraints should be optional, user-selectable, or clearly justified as region-specific.
The user-facing description and CLI help strings are written only in Chinese, including the script description and argument/option help text. This imposes a specific language on users without any opt-in or alternative locale, which matches the language/locale policy violation criteria.
The header comment states this is a 'PDF转图片脚本' that converts PDF pages into images, but the code never renders or saves PNG/JPG output. Instead, each page is copied into a new PDF and written as a .pdf file, while even the inline comments acknowledge it is only exporting PDF for later conversion.
The skill manifest promises PDF conversion features, and this script exposes image-format options and presents itself as a PDF-to-image tool. However, the actual behavior only splits the source PDF into per-page PDF files, which does not match the claimed conversion to PNG/JPG images.
The markdown advertises one-click processing of up to 100 PDF files and batch operations over an entire folder, but it does not include any user-facing warning about output handling, possible overwrites, or the impact of modifying many files at once. For a skill that can affect user data at scale, the description should disclose such risks.
The natural-language content presented to users is entirely in Chinese, including the description and section text, with no indication that other languages are supported or that Chinese is a required locale. Under the stated policy, forcing a specific language without user opt-in can be a language/locale policy violation.
The package description is written entirely in Chinese ("PDF批量处理技能包 - 合并、分割、压缩、转换") with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific context. This can constitute a language/locale policy issue because it imposes a specific language without user opt-in.
Using a caret range for pdf-lib allows future compatible-version updates to be installed without explicit review, which weakens supply-chain reproducibility and can introduce vulnerable or malicious transitive code unexpectedly. In a document-processing skill that handles untrusted PDFs, dependency drift increases risk because parser-related libraries are security-sensitive.
"batch": "node scripts/batch.js"
},
"dependencies": {
"pdf-lib": "^1.17.1",
"sharp": "^0.33.0",
"pdf2pic": "^3.1.0",
"commander": "^11.0.0",
Using an unpinned version range for sharp is a supply-chain risk because installs may resolve to different releases over time, including ones with security regressions or vulnerable native components. This is more concerning here because sharp processes document/image content and has a history of security advisories, so dependency drift can expose the skill to memory corruption, parsing, or build-time issues.
},
"dependencies": {
"pdf-lib": "^1.17.1",
"sharp": "^0.33.0",
"pdf2pic": "^3.1.0",
"commander": "^11.0.0",
"glob": "^10.3.0"
The manifest includes sharp without pinning to a known-safe version, and sharp/libvips have relevant published advisories. Because this skill performs PDF/image processing, unresolved native-library vulnerabilities could expose the host to malicious document-triggered parsing issues or unsafe build/install behavior.
An unpinned pdf2pic dependency permits nondeterministic installs and reduces assurance that the deployed package matches what was tested. Because this tool converts PDFs to images, it likely relies on complex parsing/conversion chains where vulnerable dependency updates could materially affect security.
"dependencies": {
"pdf-lib": "^1.17.1",
"sharp": "^0.33.0",
"pdf2pic": "^3.1.0",
"commander": "^11.0.0",
"glob": "^10.3.0"
},
Leaving commander unpinned is a supply-chain hygiene issue because dependency resolution can change across installs and environments. While commander itself is not especially sensitive in this manifest, reproducible builds are important for preventing accidental introduction of vulnerable or compromised package versions.
"pdf-lib": "^1.17.1",
"sharp": "^0.33.0",
"pdf2pic": "^3.1.0",
"commander": "^11.0.0",
"glob": "^10.3.0"
},
"keywords": ["pdf", "merge", "split", "compress", "convert", "automation"],
An unpinned glob dependency creates a supply-chain risk by allowing different versions to be installed over time, including versions affected by known advisories. This matters more in an automation-oriented PDF toolkit because file pattern expansion may interact with user-controlled paths or CLI workflows, increasing the chance that a vulnerable release could become exploitable.
"sharp": "^0.33.0",
"pdf2pic": "^3.1.0",
"commander": "^11.0.0",
"glob": "^10.3.0"
},
"keywords": ["pdf", "merge", "split", "compress", "convert", "automation"],
"author": "AI-Company",
The manifest uses glob without an exact version, and known advisories exist for certain glob CLI behavior involving shell execution. The risk is somewhat reduced because this package.json alone does not show direct use of the vulnerable CLI flags, but the lack of version pinning prevents verification that a safe release is installed.
The script's natural-language interface strings and CLI descriptions are entirely in Chinese, including the title, argument help, and runtime messages. This imposes a specific language on users without any opt-in, fallback, or documentation that the skill is intended only for a Chinese-speaking or region-specific context.
This file contains natural-language descriptions and console messages exclusively in Chinese, including the title, CLI help text, and runtime output. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly justified.
No suspicious patterns detected.