pdf-markdown-local
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Python scripts and shell commands (
uv run,test,wc) to perform PDF conversion and verify output. These are standard operations for the skill's purpose and include safety checks such as verifying file existence and restricting output locations. - [EXTERNAL_DOWNLOADS]: The skill uses
uvto manage themarkitdowndependency from PyPI. This is a standard and well-known Python package registry. The dependency is pinned and managed in an isolated environment, which is a security best practice for AI agent skills. - [DATA_EXFILTRATION]: Instructions explicitly state that remote URLs should not be converted and PDFs should not be uploaded to cloud services unless permitted. File access is restricted to the user-provided local paths. No unauthorized network operations were found.
- [PROMPT_INJECTION]: No evidence of prompt injection, jailbreak attempts, or instructions to ignore safety filters was found in the markdown body or metadata.
- [CREDENTIALS_UNSAFE]: No hardcoded secrets, API keys, or instructions to access sensitive credential files (like .env or .ssh) were detected.
- [SAFE]: The skill performs legitimate file conversion tasks using established libraries and follows the principle of least privilege by confining its actions to the local directory provided by the user.
Audit Metadata