Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local document-conversion pipeline that re-skins BII HTML into BlackRock-style HTML/PDF/PPTX outputs without evidence of hidden persistence, exfiltration, or destructive behavior.
Before installing, confirm you have the right to use the BlackRock-style visual identity and keep the injected non-BlackRock provenance statement in the output. Run the pipeline only on trusted BII HTML/PDF inputs, review the generated files before distribution, and avoid the maintainer publishing commands unless you are intentionally publishing this skill.
# ── 门 6 · PDF 页数与页面尺寸 ─────────────────────────────────────────
if a.pdf and os.path.exists(a.pdf):
info = subprocess.run(['pdfinfo', a.pdf], capture_output=True, text=True).stdout
npg = int(re.search(r'^Pages:\s+(\d+)', info, re.M).group(1))
m = re.search(r'^Page size:\s+([\d.]+)\s+x\s+([\d.]+)', info, re.M)
w, h = float(m.group(1)), float(m.group(2))def pdfinfo(pdf):
out = subprocess.run(['pdfinfo', pdf], capture_output=True, text=True).stdout
pages = int(re.search(r'^Pages:\s+(\d+)', out, re.M).group(1))
m = re.search(r'^Page size:\s+([\d.]+)\s+x\s+([\d.]+)\s+pts', out, re.M)
if not m:def page_text(pdf, n, keep_footer):
t = subprocess.run(['pdftotext', '-f', str(n), '-l', str(n), '-layout', pdf, '-'],
capture_output=True, text=True).stdout
lines = [re.sub(r'\s+$', '', l) for l in t.splitlines()]
lines = [l for l in lines if l.strip()]def render_pages(pdf, dpi, tmpdir):
subprocess.run(['pdftoppm', '-r', str(dpi), '-png', pdf,
os.path.join(tmpdir, 'pg')], check=True)
return [os.path.join(tmpdir, f)
for f in sorted(os.listdir(tmpdir)) if f.endswith('.png')]No suspicious patterns detected.