Security audit

Ai Pdf Builder

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed PDF-building helper, with ordinary cautions around installing document tools and using optional AI features on sensitive files.

Install only if you are comfortable running the referenced npm CLI and Pandoc/LaTeX setup commands on your machine. Use AI features only with documents you are allowed to share with Anthropic/Claude, protect the API key, and avoid processing confidential legal or investor materials unless that data sharing is approved.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill advertises AI generation features and instructs users to set an Anthropic API key, but it does not clearly warn that prompts and document content may be transmitted to Anthropic for processing. Because the tool is explicitly used for legal, investor, and business documents, users may unknowingly send sensitive or privileged information to a third-party API.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The agent instructions tell agents to generate and send PDFs to the user, but they omit safeguards for handling sensitive legal and business material. In this context, the generated files may contain contracts, term sheets, NDAs, or reports, so absent warnings or checks can lead to accidental disclosure, misdelivery, or insecure handling of confidential content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.