make-pdf

Pass

Audited by Gen Agent Trust Hub on Jul 25, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill uses environment variables (NUTRIENT_API_KEY) for API authentication, ensuring that sensitive credentials are not hardcoded within the source files.
  • [COMMAND_EXECUTION]: Execution of local helper scripts and the verapdf tool is handled using safe subprocess methods (asyncio.create_subprocess_exec and subprocess.run) with argument arrays, which prevents command injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The skill downloads standard, well-known libraries such as nutrient-dws and markdown-it-py from official package registries to perform its document conversion tasks.
  • [SAFE]: File system operations are restricted to reading input files and writing generated PDF/HTML outputs to user-specified paths, consistent with the skill's primary purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 25, 2026, 09:21 AM
Security Audit — agent-trust-hub — make-pdf