Security audit
Security checks for vulnerabilities and agentic risk
This PDF-editing skill is not malicious, but it asks users to accept broader command, file, API, and workflow behavior than its PDF purpose explains.
Install only if you are comfortable granting a PDF utility local read/write and command execution access, and avoid setting any generic API key unless the publisher clearly identifies the service, scope, and reason it is required. Review commands before execution and keep usage limited to intended PDF files.
The skill is presented as a PDF editing tool, but the documentation expands its scope to workflow orchestration, DAG execution, branching, retries, and execution reporting. That mismatch can normalize broader behavior than users expect and may justify over-privileged tool use such as unrestricted command execution or external service access under the guise of a simple PDF utility.
A local PDF CLI editing skill should not ordinarily require an API key or implied outbound API use, yet the documentation instructs users to export a generic API_KEY and references LLM/API dependencies. This encourages unnecessary secret exposure and may cause agents or users to provision network credentials and external connectivity that are unrelated to the core task.
The documentation advertises multi-format file handling, external API integration, and generic command execution beyond the stated role of editing PDFs. This kind of scope inflation can mislead operators into granting unnecessary permissions, increasing the attack surface and making abuse of file, network, or shell capabilities more plausible.
Describing the skill as capable of executing system commands in a sandbox is broader than justified for a narrow PDF editing function, especially when paired with natural-language instructions. In practice, this can lead to user-controlled shell invocation or overbroad exec permissions, turning a document utility into a general command execution surface.
The summary fields present the skill content in both Chinese and English, and the rest of the document is predominantly Chinese, but there is no explicit statement that users may choose their preferred language. This can create a language/locale policy concern if the skill experience effectively defaults to a specific language without opt-in.
The file introduces the skill as providing information-organization style capabilities, but the later usage guide describes workflow DAG parsing, ordered task execution, branching, retries, and execution reports. This is not merely incomplete wording; it presents a different operational intent than the later documentation.
No suspicious patterns detected.
