Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward HTML/URL-to-image API integration, but users should avoid sending sensitive HTML or private URLs to the third-party service.
Install only if you are comfortable sending the HTML, CSS, dynamic parameters, or public webpage URL to pdfapihub.com for rendering. Do not submit secrets, private internal URLs, session-bearing pages, confidential templates, or personal data unless you have approved that service for such use.
The skill explicitly instructs users to send raw HTML content or a public URL to a third-party service, but it provides no warning about privacy, data handling, or the risks of transmitting sensitive page contents externally. This can lead users to unknowingly expose proprietary templates, embedded secrets, personal data, or internal-only URLs to an external processor.
The example usage demonstrates direct transmission of user-supplied HTML to an external API endpoint, confirming real external data flow rather than a hypothetical capability. If an agent uses this skill on sensitive content, the data leaves the local trust boundary and may be retained, logged, or processed by the third party.
curl -X POST https://pdfapihub.com/api/v1/generateImage \
-H "CLIENT-API-KEY: your_api_key" \
-H "Content-Type: application/json" \
-d '{
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Notes
- Files are automatically deleted after 30 days
- Maximum output file size depends on your plan tier
This JSON manifest-like file defines a capability but provides no natural-language restriction on when it should be invoked, what user intent it is meant to satisfy, or what requests should not trigger it. For manifest files, missing specificity around invocation scope can lead to unintended activation because there is no bounded description of appropriate use.
The HTML template contains the fixed phrase "Hello {{name}}", which forces English output with no indication that the user can choose a language or locale. This is a natural-language policy concern because the skill bakes in a specific language rather than offering opt-in or configurability.
No suspicious patterns detected.