pdf-reader
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/install.pyhelper facilitates the installation of thepdf-inspectorlibrary and its associated Node.js and Rust bindings. These installations use standard package managers (pip,npm,cargo) to fetch official releases of thepdf-inspectortool from Firecrawl. - [COMMAND_EXECUTION]: The
scripts/pdf_read.pyscript supports an optional OCR fallback via the--ocr-cmdflag, which executes a shell command for pages lacking embedded text. The script implements a_shell_quotefunction that applies platform-specific quoting (e.g.,shlex.quoteon POSIX) and rejects potentially dangerous characters on Windows (like%and!) to prevent command injection from malicious file names or metadata. - [SAFE]: The skill includes an output sanitization layer (
_sanitize) that strips terminal control characters (ANSI escape sequences), C0/C1 controls, and Unicode line separators from the extracted PDF text. This prevents a malicious document from attempting to manipulate the agent's terminal or environment through smuggled escape sequences.
Audit Metadata