{"data":{"skill":{"slug":"zhanlincui-pdf","name":"pdf","icon":"📦","repo":"https://github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/pdf","status":"approved","author":"ZhanlinCui","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"330cdbcd-bb6a-4881-b366-a920bfb5a692","skill_id":"484a2be3-edbc-4ee7-ab57-3e75d2f5033d","version":2,"content_hash":"ab3fee50b68f898eadc8867ff421128b","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis reported many external command, filesystem, network, weak-crypto, and C2 keyword matches. Manual review found legitimate PDF documentation and helper scripts, with no prompt injection, exfiltration, malware intent, or hidden network calls. The skill remains medium risk because it guides agents to run local scripts and PDF command-line tools that read and write user-selected files.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"scripts/check_bounding_boxes.py","line_end":70,"line_start":17},{"file":"scripts/extract_form_field_info.py","line_end":152,"line_start":140},{"file":"scripts/fill_fillable_fields.py","line_end":114,"line_start":106},{"file":"scripts/fill_pdf_form_with_annotations.py","line_end":108,"line_start":100}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":197,"line_start":169},{"file":"forms.md","line_end":5,"line_start":3},{"file":"forms.md","line_end":75,"line_start":74},{"file":"reference.md","line_end":340,"line_start":265}]},{"factor":"filesystem","evidence":[{"file":"scripts/extract_form_field_info.py","line_end":145,"line_start":140},{"file":"scripts/fill_fillable_fields.py","line_end":56,"line_start":12},{"file":"scripts/fill_pdf_form_with_annotations.py","line_end":94,"line_start":28},{"file":"reference.md","line_end":501,"line_start":488}]},{"factor":"network","evidence":[{"file":"scripts/extract_form_field_info.py","line_end":32,"line_start":31},{"file":"scripts/extract_form_field_info.py","line_end":81,"line_start":79},{"file":"scripts/fill_pdf_form_with_annotations.py","line_end":78,"line_start":77}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Local File Read and Write Workflows","locations":[{"file":"scripts/extract_form_field_info.py","line_end":145,"line_start":140},{"file":"scripts/fill_fillable_fields.py","line_end":56,"line_start":12},{"file":"scripts/fill_pdf_form_with_annotations.py","line_end":94,"line_start":28},{"file":"scripts/convert_pdf_to_images.py","line_end":23,"line_start":10}],"confidence":0.86,"description":"The helper scripts read user-provided PDF or JSON paths and write PDFs, images, or JSON outputs. This is expected for PDF processing, but users should run it only on trusted local paths and review output destinations.","confidence_reasoning":"The scripts directly open paths from command arguments and write local output files. The behavior is legitimate for this skill, but it is a real filesystem capability."},{"title":"External PDF Tool Commands in Documentation","locations":[{"file":"SKILL.md","line_end":197,"line_start":169},{"file":"forms.md","line_end":5,"line_start":3},{"file":"forms.md","line_end":75,"line_start":74},{"file":"reference.md","line_end":340,"line_start":265}],"confidence":0.78,"description":"The instructions include shell commands for tools such as pdftotext, qpdf, pdftk, and pdfimages. These are local PDF utilities, not hidden execution paths, but they can modify or decrypt files when used by an agent.","confidence_reasoning":"The command examples are explicit and relevant to PDF manipulation. I found no evidence that the skill dynamically constructs shell commands or executes them without user intent."}],"low_findings":[{"title":"Documentation URLs Misclassified as Network Activity","locations":[{"file":"scripts/extract_form_field_info.py","line_end":32,"line_start":31},{"file":"scripts/extract_form_field_info.py","line_end":81,"line_start":79},{"file":"scripts/fill_pdf_form_with_annotations.py","line_end":78,"line_start":77}],"confidence":0.94,"description":"The hardcoded URLs are references in comments to PDF specifications, form behavior, or library issues. No HTTP client, fetch call, credential transfer, or outbound request was found in these locations.","confidence_reasoning":"The cited lines are comments only. There is no network library usage or runtime request tied to these URLs."},{"title":"High-Risk Keyword Matches Are False Positives","locations":[{"file":"SKILL.md","line_end":4,"line_start":1},{"file":"reference.md","line_end":340,"line_start":331},{"file":"scripts/check_bounding_boxes_test.py","line_end":23,"line_start":14},{"file":"scripts/check_bounding_boxes.py","line_end":26,"line_start":23}],"confidence":0.89,"description":"Static matches for weak cryptography and C2 terminology come from PDF documentation terms, Markdown backticks, tests, and examples. No evidence found of malware control channels, credential theft, or weak cryptographic implementation.","confidence_reasoning":"Manual review found benign PDF processing context at representative static-hit locations. The high-risk labels do not align with the actual code behavior."}],"dangerous_patterns":[{"title":"Local File Read and Write Workflows","locations":[{"file":"scripts/extract_form_field_info.py","line_end":145,"line_start":140},{"file":"scripts/fill_fillable_fields.py","line_end":56,"line_start":12},{"file":"scripts/fill_pdf_form_with_annotations.py","line_end":94,"line_start":28},{"file":"scripts/convert_pdf_to_images.py","line_end":23,"line_start":10}],"confidence":0.86,"description":"The helper scripts read user-provided PDF or JSON paths and write PDFs, images, or JSON outputs. This is expected for PDF processing, but users should run it only on trusted local paths and review output destinations.","confidence_reasoning":"The scripts directly open paths from command arguments and write local output files. The behavior is legitimate for this skill, but it is a real filesystem capability."},{"title":"External PDF Tool Commands in Documentation","locations":[{"file":"SKILL.md","line_end":197,"line_start":169},{"file":"forms.md","line_end":5,"line_start":3},{"file":"forms.md","line_end":75,"line_start":74},{"file":"reference.md","line_end":340,"line_start":265}],"confidence":0.78,"description":"The instructions include shell commands for tools such as pdftotext, qpdf, pdftk, and pdfimages. These are local PDF utilities, not hidden execution paths, but they can modify or decrypt files when used by an agent.","confidence_reasoning":"The command examples are explicit and relevant to PDF manipulation. I found no evidence that the skill dynamically constructs shell commands or executes them without user intent."}],"files_scanned":11,"total_lines":1878,"audit_model":"codex","audited_at":"2026-07-01T03:03:48.487+00:00","created_at":"2026-07-01T04:01:05.485767+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":2,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}