Security audit
Document Scanner
Security checks across malware telemetry and agentic risk
Overview
The skill's code, instructions, and required credential (PDFAPIHub API key) are consistent with a cloud-based document-scanning service; nothing indicates behaviour outside that purpose.
This plugin sends any images you provide to PDFAPIHub for processing, so avoid uploading highly sensitive documents unless you trust that service and its retention policy. Confirm the PDFAPIHub domain and review their privacy/retention terms (SKILL.md claims files are auto-deleted after 30 days). Prefer setting the API key via environment variable (PDFAPIHUB_API_KEY) instead of embedding it in plaintext config files. Note the small metadata inconsistency: the bundle header showed no required env vars but the plugin enforces an API key — expect to supply that key to use the skill. If you need offline/local-only scanning, use a local tool instead of a cloud-based plugin.
VirusTotal
No VirusTotal findings
Static analysis
No suspicious patterns detected.