make-pdf
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
runtime-bootstrap.mjsscript downloads manifest metadata and runtime components from the officialtime-attackGitHub repository. These downloads are restricted to known release hosts and are used to provide optional local rendering capabilities. - [REMOTE_CODE_EXECUTION]: The skill facilitates the installation of a local runtime environment. This involves downloading, verifying, and executing an installer script. The execution is gated by mandatory user consent (the
--yesflag) and rigorous integrity checks. - [COMMAND_EXECUTION]: The skill utilizes Node.js and shell commands to manage its document processing and installation workflows. Commands are scoped to the user's home directory and the skill's specific operational requirements.
- [DATA_EXFILTRATION]: A diagnostic tool,
browser-provider-smoke.mjs, initiates a temporary local listener on127.0.0.1for browser readiness testing. It employs per-session random tokens and restrictive security headers to ensure the process remains isolated to the local machine and protected from external interference.
Audit Metadata