Smart Image to PDF

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:18 PM UTC
• Version:
  0.1.0

Overview

This skill does what it says: it converts user-selected images into a local printable PDF, with only ordinary file-write and dependency-fetch considerations.

Before installing, note that running this skill processes local images you provide, may download Pillow and numpy through `uv`, and writes a PDF to the chosen path or to `output.pdf` by default. Use an explicit output filename if you want to avoid accidental overwrite.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger guidance includes the very broad phrase "打印" (print), which can match many ordinary user requests unrelated to combining images into PDFs. This increases the chance of incorrect auto-invocation, causing the agent to run file-processing behavior in situations where the user did not clearly request this specific transformation.

VirusTotal

60/60 vendors flagged this skill as clean.