Pdf Toolkit

PDF工具箱 - 合并、拆分、压缩、转换PDF文件。支持批量处理，无需联网，本地执行。

Security Scan

The skill is largely what it claims (local PDF utilities) but contains inconsistencies (referenced scripts missing) and uses shell execution patterns that could allow command-injection or other surprises — review before installing or running on sensitive systems.

Purpose & Capability

The name/description (local PDF merge/split/compress/convert) matches the included scripts for most features (merge, split, compress, pdf2img, img2pdf, extract-text). However SKILL.md documents additional features (watermark.js, encrypt.js, decrypt.js) that are not present in the file manifest — this mismatch could be an omission or indicate the package is incomplete/misdocumented.

Instruction Scope

Runtime instructions are local and consistent with the code (they call Ghostscript, pdftoppm, ImageMagick, pdftk, img2pdf). They do instruct editing system config (/etc/ImageMagick-6/policy.xml) which is a privileged change affecting system security policy. The scripts call external system commands via execSync with user-provided paths — this expands scope to interacting with system binaries and filesystem in ways that could be risky if inputs are malicious or unescaped.

Install Mechanism

This is instruction-only with included Node scripts (no install spec). SKILL.md suggests 'npx clawhub@latest install pdf-toolkit' but the skill bundle itself contains the scripts, so there's no remote download performed by the skill. The only external install action is a user-invoked suggestion (npx) — inspect that package before running it.

Credentials

The skill requests no environment variables or credentials and requires only system PDF/image utilities (poppler-utils, ghostscript, ImageMagick, optionally pdftk/img2pdf). Those dependencies are proportional to a local PDF toolkit. There are no hidden credential or network requirements.

Persistence & Privilege

always is false; the skill is user-invocable and allows model invocation (platform default). The skill does not request persistent system-wide privileges or attempt to modify other skills' configs. Note: editing system ImageMagick policy requires elevated privileges and should be done deliberately.

What to consider before installing

This package mostly does what it says: local PDF operations using Ghostscript, poppler, ImageMagick, etc. Before installing or running it: - Verify missing files: SKILL.md mentions watermark.js, encrypt.js and decrypt.js but those scripts are not present — confirm whether those features are required and why they are missing. - Review the included scripts locally (they are small) before running. They invoke system commands with execSync and interpolate file paths into shell commands; filenames containing special characters could be misinterpreted and allow command injection. Avoid running these scripts on untrusted input or with untrusted filenames. - Be cautious about the recommended change to /etc/ImageMagick-6/policy.xml — that weakens ImageMagick protections for PDF handling and requires root. Understand the security tradeoff and prefer safer alternatives when possible. - Confirm and install the required system binaries (poppler-utils, ghostscript, ImageMagick, pdftk, img2pdf) from trustworthy package sources. - Prefer running the tools in a sandbox or non-privileged account and test on copies of sensitive files first. If you plan to run programmatically, consider wrapping calls to external binaries with safer APIs (execFile with args array) or sanitizing/validating all file paths. If you need certainty about absent features or want the watermark/encrypt capabilities, ask the publisher for a complete release or provide the missing scripts before trusting this skill on sensitive documents.

📄 PDF工具箱

一个强大的本地PDF处理技能，无需联网，保护隐私安全。

功能特性

• ✅ PDF合并 - 多个PDF合并为一个
• ✅ PDF拆分 - 按页码拆分PDF
• ✅ PDF压缩 - 减小PDF文件大小
• ✅ PDF转图片 - 将PDF页面转为图片
• ✅ 图片转PDF - 将图片合并为PDF
• ✅ PDF提取文字 - 提取PDF中的文本内容
• ✅ PDF添加水印 - 为PDF添加文字水印
• ✅ PDF加密/解密 - 设置或移除PDF密码

安装

npx clawhub@latest install pdf-toolkit

依赖

需要安装以下系统依赖：

# Ubuntu/Debian
sudo apt-get install poppler-utils ghostscript imagemagick

# macOS
brew install poppler ghostscript imagemagick

# Windows (使用 scoop 或 chocolatey)
scoop install poppler ghostscript imagemagick
# 或
choco install poppler ghostscript imagemagick

使用方法

1. PDF合并

node scripts/merge.js file1.pdf file2.pdf output.pdf

2. PDF拆分

# 拆分为单页
node scripts/split.js input.pdf output_dir/

# 按页码范围拆分
node scripts/split.js input.pdf output.pdf 1-5

3. PDF压缩

node scripts/compress.js input.pdf output.pdf

4. PDF转图片

# 转换所有页面
node scripts/pdf2img.js input.pdf output_dir/

# 指定分辨率 (dpi)
node scripts/pdf2img.js input.pdf output_dir/ --dpi 150

5. 图片转PDF

node scripts/img2pdf.js image1.png image2.jpg output.pdf

6. 提取文字

node scripts/extract-text.js input.pdf output.txt

7. 添加水印

node scripts/watermark.js input.pdf "机密文件" output.pdf

8. 加密/解密

# 加密
node scripts/encrypt.js input.pdf output.pdf password123

# 解密
node scripts/decrypt.js input.pdf output.pdf password123

API示例

也可以在代码中直接调用：

const { merge, split, compress, pdf2img, img2pdf } = require('pdf-toolkit');

// 合并PDF
await merge(['file1.pdf', 'file2.pdf'], 'merged.pdf');

// 拆分PDF
await split('input.pdf', 'output_dir/');

// 压缩PDF
await compress('input.pdf', 'compressed.pdf');

// PDF转图片
await pdf2img('input.pdf', 'output_dir/', { dpi: 150 });

// 图片转PDF
await img2pdf(['img1.png', 'img2.jpg'], 'output.pdf');

注意事项

1. 处理大文件时可能需要较长时间
2. 加密的PDF需要先解密才能进行其他操作
3. ImageMagick默认限制了PDF转换，可能需要修改配置：

   # 编辑 /etc/ImageMagick-6/policy.xml
   # 将 <policy domain="coder" rights="none" pattern="PDF" />
   # 改为 <policy domain="coder" rights="read|write" pattern="PDF" />
   

常见问题

Q: 为什么PDF转图片失败？

A: 检查ImageMagick的安全策略配置，详见上方注意事项。

Q: 压缩效果不明显？

A: 压缩效果取决于PDF内容类型。图片较多的PDF压缩效果更明显。

Q: 支持中文文件名吗？

A: 支持，但建议使用英文路径避免编码问题。

更新日志

v1.0.0 (2026-03-23)

• 初始版本
• 支持基础PDF操作

许可证

MIT License