pdf-to-word-docx
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches required resources, including a license verification file and an AI model for layout analysis (approximately 525MB), from the official vendor domain at download.compdf.com.
- [COMMAND_EXECUTION]: The skill executes conversion workflows by invoking the ComPDFKitConversion SDK to handle file processing and local file system output operations.
- [PROMPT_INJECTION]: As a document processing tool, the skill has a surface for indirect prompt injection if an attacker-controlled PDF contains malicious instructions that are subsequently read by the AI after conversion.
- Ingestion points: The input_pdf file path in scripts/pdf-to-word-docx.py.
- Boundary markers: Absent.
- Capability inventory: Local file read/write and network requests via urllib.request for resource management.
- Sanitization: No content-based filtering or escaping is performed on the extracted text.
- [SAFE]: Implements a local usage counter in ~/.pdf-to-word-docx/usage.json to manage the conversion limit of the trial license, which is a standard commercial software practice.
Audit Metadata