pdf

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Most links are legitimate (Google Fonts, unpkg CDN, LibreOffice, Tectonic GitHub Pages), but https://drop-sh.fullyjustified.net is a personal/custom script-hosting domain used with a "curl | sh" install command (high-risk for delivering arbitrary code), and the example.com entries are malformed/invalid — so there is a notable suspicious download source in the set.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The html_to_pdf.js conversion script will dynamically load and execute the Paged.js polyfill from the CDN at runtime when the local paged.polyfill.js is missing (await page.addScriptTag({ url: 'https://unpkg.com/pagedjs@0.4.3/dist/paged.polyfill.js' })), meaning remote JavaScript is fetched and executed as a required part of pagination.