pdf-editor-compdf

The skill is purpose-aligned and does not show clear exfiltration beyond stated email-based license activation, so it is not confirmed malware. However, it requires downloading and running an unverifiable external CLI from mutable direct ZIP URLs without documented checksum/signature verification; under the mandatory override this makes the skill high security risk and overall suspicious rather than benign.