nano-pdf

SUSPICIOUS: the core PDF-editing purpose is plausible, but the skill under-discloses its true footprint. It installs unrelated third-party code from PyPI, omits the likely Gemini credential requirement, and likely sends PDF content to an external AI service through the CLI. This is not confirmed malware, but the install trust and credential/data-flow transparency are only medium quality.