make-pdf
Warn
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a binary located in the user's home directory (
~/.claude/skills/vibestack/make-pdf/dist/pdf). It allows for arbitrary argument injection via$P generate "<source>" --output "<output.pdf>" [flags], though this is intended for standard PDF generation parameters. - [COMMAND_EXECUTION]: The 'Preamble' and 'Capture Learnings' sections execute management scripts (
vibe-slug,vibe-learnings-search,vibe-learnings-log) located in~/.vibestack/bin/. These scripts handle session metadata and log insights to~/.vibestack/projects/, which constitutes a local persistence mechanism for tracking agent activity across sessions. - [COMMAND_EXECUTION]: The skill uses
evalto set theSLUGenvironment variable from the output of a local command (eval "$(~/.vibestack/bin/vibe-slug 2>/dev/null)"). This pattern can be dangerous if the command output is influenced by untrusted project data.
Audit Metadata