Security checks across malware telemetry and agentic risk
The skill is a coherent local PDF tool, but its encryption script exposes the PDF password in console output and the dependency setup has avoidable parser supply-chain risk.
Review before installing if you will process sensitive PDFs. Avoid using the encryption script as written until the password print is removed and prefer a hidden prompt or protected secret source instead of a positional CLI password. Pin and audit document/image parser dependencies before using this in shared, automated, or untrusted-file workflows.
# 安装: pip install -r requirements.txt # 核心 PDF 处理 pymupdf>=1.23.0 pdfplumber>=0.10.0 # Word/Excel 转换
# 核心 PDF 处理 pymupdf>=1.23.0 pdfplumber>=0.10.0 # Word/Excel 转换 python-docx>=1.1.0
pdfplumber>=0.10.0 # Word/Excel 转换 python-docx>=1.1.0 openpyxl>=3.1.0 # 图片处理
# Word/Excel 转换 python-docx>=1.1.0 openpyxl>=3.1.0 # 图片处理 Pillow>=10.0.0
openpyxl>=3.1.0 # 图片处理 Pillow>=10.0.0 # 可选: OCR 支持 # pytesseract>=0.3.10
# tessdata>=4.1.0 # 测试 pytest>=7.4.0 pytest-cov>=4.1.0
# 测试 pytest>=7.4.0 pytest-cov>=4.1.0
65/65 vendors flagged this skill as clean.
