Ai Pdf Builder

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill may execute code from the npm package and local PDF toolchain on the user's machine.

Why it was flagged

The core workflow runs an external npm CLI at runtime. This fits the PDF-generation purpose, but the executable package code is not included in the skill artifacts, so users should trust and verify that package before use.

Skill content
npx ai-pdf-builder generate whitepaper ./content.md -o output.pdf
Recommendation

Verify the npm package and repository, consider pinning a known-good version, and run it only in a project directory where the tool should operate.

What this means

The API key may allow paid or quota-limited use of the user's Anthropic account when AI generation features are used.

Why it was flagged

The skill documents an optional Anthropic API key for AI features. This is expected for Claude-backed generation, but the registry metadata does not declare a primary credential or required environment variable.

Skill content
export ANTHROPIC_API_KEY="your-key-here"
Recommendation

Use a revocable, least-privilege API key where possible, store it as an environment variable rather than in prompts or files, and rotate it if exposed.

What this means

Confidential legal, investor, or business documents could be sent to an external AI service when AI enhancement or summarization is used.

Why it was flagged

The skill's AI features are described as using Claude and operating on prompts or user-provided files. For enhance and summarize workflows, document contents may be processed by an external AI provider.

Skill content
**AI Content Generation** - Generate documents from prompts using Claude ... `enhance <file>` - Improve existing content ... `summarize <file>` - Create executive summary
Recommendation

Use local generation for sensitive documents when possible, redact confidential information before AI processing, and confirm provider data-handling policies before using AI features.