Security audit
Security checks for vulnerabilities and agentic risk
This skill openly converts documents by uploading them to PDFAPIHub, with no hidden code, persistence, or unrelated access found.
Install only if you are comfortable sending documents and an API key to PDFAPIHub. Do not use it for confidential, regulated, or proprietary files unless you have independently accepted the provider's handling and retention practices.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://pdfapihub.com/api/v1/convert/docx/pdf \
-H "CLIENT-API-KEY: your_api_key" \
-H "Content-Type: application/json" \
-d '{
The skill explicitly states that user documents are uploaded to pdfapihub.com for conversion, yet it provides no explicit warning about privacy, retention, third-party processing, or suitability for sensitive data. This is dangerous because users or calling agents may transmit confidential, regulated, or proprietary documents to an external cloud service without informed consent or handling safeguards.
This manifest names the skill and describes what it does, but it does not provide any explicit invocation constraints, trigger phrases, or exclusion conditions. In a manifest file, that broad description could allow matching on generic requests about converting documents without clarifying when the skill should or should not activate.
No suspicious patterns detected.