Security audit
Security checks across malware telemetry and agentic risk
This looks like a real local CAJ-to-PDF converter, but it asks users to trust automatic dependency installation, embedded Windows DLLs, and optional system-level Windows integration that are not cleanly scoped as an offline converter.
Install only if you are comfortable with a converter that may set up its own Python environment, download dependencies from a third-party PyPI mirror, extract embedded closed-source Windows DLLs, and includes optional registry integration. Treat it as a local document-conversion tool, avoid running the bundled install/context-menu command unless you want Windows registry changes, and use it only on documents and systems where those setup behaviors are acceptable.
JBigDecode_cc,
decode_jbig2data_cc,
):
dep_checker = run(["pkg-config", "--libs", "--cflags", "poppler"], stdout=PIPE)
if dep_checker.returncode != 0:
print("poppler 未安装，请通过系统包管理器安装", file=stderr)
exit(-1)jbigdec_cc,
JBigDecode_cc,
]
run(cmd_jbigdec)
print("BUILD: {}".format(libjbigdec_so))
poppler_flags = dep_checker.stdout.decode("utf-8").strip().split(" ")libjbig2codec_so,
decode_jbig2data_cc,
]
run(cmd_jbig2codec)
print("BUILD: {}".format(libjbig2codec_so))JBigDecode_cc,
decode_jbig2data_x_cc,
):
dep_checker = run(["pkg-config", "--libs", "--cflags", "jbig2dec"], stdout=PIPE)
if dep_checker.returncode != 0:
print("jbig2dec 未安装，请通过系统包管理器安装", file=stderr)
exit(-1)jbigdec_cc,
JBigDecode_cc,
]
run(cmd_jbigdec)
print("BUILD: {}".format(libjbigdec_so))
jbig2dec_flags = dep_checker.stdout.decode("utf-8").strip().split(" ")libjbig2codec_so,
decode_jbig2data_x_cc,
]
run(cmd_jbig2codec)
print("BUILD: {}".format(libjbig2codec_so))# Use mutool to repair xref (optional; fall back if mutool unavailable)
try:
check_output(["mutool", "clean", "pdf.tmp", "pdf_toc.pdf"], stderr=STDOUT)
except FileNotFoundError:
# mutool not installed in this environment; keep the generated PDF as-is
copy("pdf.tmp", "pdf_toc.pdf")# Use mutool to repair xref (optional; fall back if mutool unavailable)
try:
check_output(["mutool", "clean", dest + ".tmp", dest], stderr=STDOUT)
except FileNotFoundError:
# mutool not installed in this environment; keep the generated PDF as-is
copy(dest + ".tmp", dest)pass
else:
try:
utime = subprocess.check_output(["date", "--date", string, "+%s"])
except subprocess.CalledProcessError:
pass
else:elif key == "indirect":
pass
else:
self.content[getattr(MyPdfName, key)] = value
def tostring(self):
if self.stream is not None:"last": "/Last",
}
for k, v in opt_keys.items():
n = getattr(t["node"], k)()
if n is not None:
oli.update({PDF.NameObject(v): idorefs[n.index]})
olitems.append(oli)if os.path.exists(vpy):
return vpy
print("[convert] venv not found, running setup.py ...")
subprocess.run([sys.executable, os.path.join(SKILL_DIR, "setup.py")], check=True)
if not os.path.exists(vpy):
sys.exit("[convert] FATAL: venv still missing after setup.")
return vpy# 1) 确保运行在 venv 中
vpy = ensure_venv()
if sys.executable != vpy and os.path.exists(vpy):
subprocess.run([vpy, __file__, *sys.argv[1:]], check=True)
return
# 2) 解析参数# 建 venv
print("[setup] creating venv ...")
subprocess.run([base_py, "-m", "venv", VENV], check=True)
# 装依赖（阿里云镜像，国内快；pyproject 也指向此镜像）
print(f"[setup] installing deps via {PYPI_MIRROR} ...")# 装依赖（阿里云镜像，国内快；pyproject 也指向此镜像）
print(f"[setup] installing deps via {PYPI_MIRROR} ...")
subprocess.run([venv_pip(), "install", "-i", PYPI_MIRROR, *DEPS], check=True)
# 校验
subprocess.run([vpy, "-c", "import fitz, imagesize, PyPDF2; print('deps ok')"], check=True)subprocess.run([venv_pip(), "install", "-i", PYPI_MIRROR, *DEPS], check=True)
# 校验
subprocess.run([vpy, "-c", "import fitz, imagesize, PyPDF2; print('deps ok')"], check=True)
print("[setup] DONE. caj-to-pdf environment is ready.")# 已存在且关键依赖（fitz）可用 -> 跳过
if os.path.exists(vpy):
try:
subprocess.run([vpy, "-c", "import fitz, imagesize, PyPDF2"],
check=True, capture_output=True)
print("[setup] venv already ready, nothing to do.")
returnVirusTotal findings are pending for this skill version.
Detected: suspicious.obfuscated_code