Markdown2pdf

What to check before installing: - Verify provenance: the SKILL.md / README point to a GitHub repo but the registry lists source=unknown and versions mismatch — confirm the repository and maintainer identity (inspect https://github.com/leohuang8688/markdown2pdf) and prefer upstream releases. - Inspect SKILL.md and other docs for invisible characters (unicode control chars) flagged by the scanner; those should be removed or explained. Invisible control characters are not required for conversion and may be malicious in agent contexts. - Confirm and install wkhtmltopdf from the official site (https://wkhtmltopdf.org) before using the skill; the registry metadata omitted this required binary. Running the included install.sh will pip-install Python packages but will not install wkhtmltopdf for you. - Review install.sh and the Python source (src/converter.py and src/emoji_replacer.py) for any network calls or unexpected behavior before running tests. Run tests and the conversion in an isolated/sandboxed environment if possible. - Because the package includes example output files with financial reports and an email contact, be cautious about any automatic uploading or external-posting behavior if you integrate this skill into an automated pipeline — search the code for HTTP endpoints or credentials usage (none were obvious in the provided excerpts, but a full search is prudent). If the SKILL.md is cleaned of control characters, the required binary (wkhtmltopdf) is clearly documented in the registry metadata, and the GitHub source/provenance is validated, this assessment would likely move to benign. Until then treat it as suspicious and validate manually.