Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward chart-generation API wrapper, with the main consideration that chart data and an API key are sent to PDFAPIHub.
Install only if you are comfortable sending chart configuration data to PDFAPIHub and managing a PDFAPIHub API key. Treat the key as sensitive and avoid putting confidential business, financial, or personal data in charts unless the provider's retention and privacy terms fit your use case.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://pdfapihub.com/api/v1/generateChart \
-H "CLIENT-API-KEY: your_api_key" \
-H "Content-Type: application/json" \
-d '{
This markdown file applies to SQP-2, and it explicitly requires transmitting a credential via the CLIENT-API-KEY header. The documentation does not include any caution about protecting the API key, avoiding exposure in shared logs/shell history, or treating it as sensitive credential material.
The stated description implies the skill itself generates chart images using Chart.js, while the file demonstrates sending chart configuration to pdfapihub.com for remote generation and hosting. That is a semantic mismatch between a local Chart.js-based generator and a wrapper around an external chart-generation API.
No suspicious patterns detected.