URL to PDF

Convert URL to PDF suitable for mobile reading.

Security Scan

The skill's code and instructions generally match its stated purpose (converting a URL to a mobile-styled PDF), but there are a few mismatches and privileges that warrant caution — notably always:true inclusion, writing files to user paths, and an undocumented environment variable.

Purpose & Capability

Name and description match the bundled Python script which uses Playwright to load a webpage and print a PDF sized for an iPhone. The declared required binary 'uv' fits the script's shebang/comments that rely on uv to install/run dependencies.

Instruction Scope

SKILL.md tells the agent to run the script and send the generated PDF. The script reads an environment variable PDF_OUT_DIR (OUT_DIR) to choose where to write the PDF, but that env var is not declared in the skill requirements or documented in SKILL.md. The script writes files under the chosen path (default ~/Documents). The skill will also navigate to arbitrary URLs provided as input — expected for the feature but worth noting as it grants the skill network access and the ability to fetch arbitrary remote content.

Install Mechanism

No explicit install spec in registry; the skill is instruction-only but includes a Python script that relies on uv to install Playwright and python-slugify. Playwright will install browser binaries (chromium) via uvx, which is a large download but expected for this capability. No obscure URLs or third-party installers are present in the manifest or code.

Credentials

The skill does not declare any required environment variables but the script uses PDF_OUT_DIR to choose output location. That env var can redirect output to arbitrary filesystem locations. No API keys or unrelated credentials are requested, which is good, but the undocumented env var and default write to ~/Documents increase risk if misconfigured or if the agent runs with elevated filesystem access.

Persistence & Privilege

The skill is marked always: true which forces it to be included in every agent run. Combined with its ability to fetch arbitrary URLs, write files to user-controlled locations, and run a browser engine, this persistent inclusion increases blast radius and should be justified. The skill does not modify other skills or system configs, but always:true is a notable privilege.

What to consider before installing

This skill appears to do what it says (convert a webpage to a mobile-formatted PDF), but consider these points before installing: - always:true: The skill is force-included in every agent run. If you don't want it available automatically, avoid installing or request the owner remove always:true. - Filesystem writes: By default it writes PDFs to ~/Documents and respects an environment variable PDF_OUT_DIR (not documented in the registry). Ensure the runtime environment does not set PDF_OUT_DIR to a sensitive location and that the agent runs with least privilege. - Network access: The skill opens arbitrary URLs you provide. That is required for its function but also means the skill can fetch remote content; do not let it fetch URLs you don't trust. - Install size/side effects: Running it will pull Playwright and browser binaries (chromium) via uv/uvx — expect a large download and additional runtime components. - Trust and sandboxing: Only install if you trust the author or run the skill in a sandboxed environment. If you need stricter controls, ask the maintainer to remove always:true, document PDF_OUT_DIR, and limit where files can be written. If you want to proceed: run the script in an isolated environment (container or VM), set PDF_OUT_DIR to a safe directory you control, and review the provided Python source (url2pdf.py) yourself. If you are unsure, do not enable always:true and require on-demand invocation instead.

Given a url for a webpage, convert it to pdf suitable for mobile reading.

See examples.

Requirements

• uv

Installation

playwright itself will be installed by uv automatically, while it also needs browser to be installed:

uvx playwright install chromium

Usage

uv run --script ${baseDir}/url2pdf.py "${url}"

Path to pdf will be printed to stdout.

Agent Instructions

1. Run the script: Pass the url to be converted as an argument.
2. Handle Output: The script will output a path to a pdf file. Use the message tool to send the pdf file to the user as a document message:

{
   "action": "send",
   "filePath": "<filepath>"
}