lov-any2pdf

Warn

Audited by Socket on Oct 3, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/md2pdf.py

The code is a document-rendering utility with no clear malware indicators or covert data-theft behavior. The primary security concern is network and local-file access through user-controlled image sources: arbitrary HTTP(S) URLs can cause server-side requests, and file:// or local paths can cause accessible files to be embedded in the output PDF. Restrict image schemes and hosts, enforce response-size limits, validate image content, and sandbox or disable remote images when processing untrusted Markdown. The provided fragment also appears truncated or syntactically invalid at the final main( call.

Confidence: 98%Severity: 58%
Audit Metadata
Analyzed At
Oct 3, 2026, 10:02 PM
Package URL
pkg:socket/skills-sh/lovstudio%2Fskills%2Flov-any2pdf%2F@0fefa18229aa32160d0ac865c763fcf4409b3b156f88a111ba6b3a29667ed9e8