URL to PDF

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: url2pdf Version: 0.0.2 The skill bundle is designed to convert a given URL to a PDF file. The `SKILL.md` instructions guide the agent to execute the `url2pdf.py` script and then send the generated PDF to the user. The Python script uses `playwright` to browse the specified URL and save it as a PDF, defaulting to `~/Documents` or a user-specified path. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent. All observed behaviors are aligned with the stated purpose of the skill.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing or first using the skill may download Playwright-related packages and a Chromium browser component.

Why it was flagged

The skill depends on uv-managed package/browser installation. This is expected for Playwright-based PDF generation, but it means installation pulls external components.

Skill content
playwright itself will be installed by uv automatically, while it also needs browser to be installed:
uvx playwright install chromium
Recommendation

Install only if you are comfortable with uv/Playwright dependencies, and prefer a trusted network/package environment.

What this means

Using the skill runs a local script that launches Chromium through Playwright to visit the requested page and generate a PDF.

Why it was flagged

The skill’s normal operation is to run a local Python script with the provided URL. This local execution is central to the stated purpose and not hidden.

Skill content
uv run --script ${baseDir}/url2pdf.py "${url}"
Recommendation

Use it for URLs you intend to render as PDFs; avoid passing sensitive or untrusted local file URLs unless you deliberately want them converted.

What this means

The skill will create or overwrite a PDF path derived from the URL in the configured output location.

Why it was flagged

The script navigates to the supplied URL and writes a PDF file to a local output path, defaulting under Documents. This matches the skill’s purpose but is still local file and network/browser activity.

Skill content
OUT_DIR = os.getenv("PDF_OUT_DIR", "~/Documents") ... return path / f"{slug}.pdf" ... page.goto(url, wait_until="domcontentloaded", timeout=30000) ... device.save_as_pdf(page, pdf_path)
Recommendation

Check the output location if file naming conflicts matter, and set PDF_OUT_DIR or an explicit output path if you want PDFs saved somewhere specific.