Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward PDF-to-image wrapper for an external API, with no hidden code or persistence, but users should treat submitted PDFs as shared with that service.
Install only if you are comfortable sending the PDF file or PDF URL to pdfapihub.com for processing. Do not use confidential, regulated, or internal-only documents unless your organization has approved that provider and its retention and privacy practices.
The skill instructs users to submit either a public PDF URL or the PDF file itself to an external service, but it does not clearly disclose this data flow or warn about privacy, confidentiality, and third-party handling implications. This can cause users to unknowingly send sensitive documents or internal URLs to a third party, increasing the risk of data exposure and compliance issues.
The example usage explicitly sends user-supplied PDF data or URLs to https://pdfapihub.com/api/v1/convert/pdf/image, confirming external transmission to a third-party service. In this context the behavior is expected for the skill's functionality, but it is still security-relevant because documents may contain confidential information and the skill does not pair the transmission with adequate warnings or handling guidance.
curl -X POST https://pdfapihub.com/api/v1/convert/pdf/image \
-H "CLIENT-API-KEY: your_api_key" \
-H "Content-Type: application/json" \
-d '{
The example sends a PDF URL to a third-party conversion API and returns externally hosted image URLs, which means document access patterns and potentially sensitive document contents are processed outside the local environment implied by the skill's description. This creates data exposure, retention, and trust-boundary risks if users assume conversion is local or first-party.
The skill relies on an external network service for a function that users may reasonably expect to be local-only, exposing document locations and enabling third-party processing of user-supplied content. Even when only a URL is submitted, the external service may fetch, log, store, or further distribute the referenced document, increasing confidentiality and compliance risk.
The manifest sends user-supplied PDFs to a third-party service at https://pdfapihub.com/api but does not disclose that document contents leave the local agent environment. PDFs often contain sensitive business or personal data, so users may unknowingly transmit confidential information to an external processor, creating privacy, compliance, and data-handling risk.
No suspicious patterns detected.