md-to-pdf
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs Markdown to PDF conversion using established tools (crossnote, Puppeteer/Chrome). No malicious patterns or behaviors were identified.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided Markdown files. This attack surface is well-mitigated in the primary Node.js implementation (
md-to-pdf.cjs) by explicitly disabling script execution (enableScriptExecution: false) and code chunk evaluation (runAllCodeChunks: false) within the rendering engine. - [EXTERNAL_DOWNLOADS]: The skill depends on reputable, standard Node.js packages for document processing (
crossnote,gray-matter,he). These are legitimate libraries and do not represent a security risk. - [COMMAND_EXECUTION]: Both the bash and Node.js scripts correctly handle user-supplied file paths using quoting and absolute path resolution, preventing command injection through malicious file naming conventions.
Audit Metadata