pdf-reader

This module is primarily a PDF-to-Markdown converter with an optional OCR fallback. It contains no obvious covert malware behavior (no exfiltration, persistence, or hidden payloads). The dominant security concern is explicit execution of a user-supplied OCR command template via subprocess.Popen(..., shell=True). If an attacker can influence --ocr-cmd (directly or indirectly), the module can be used to run arbitrary commands on the host. Otherwise, with trusted --ocr-cmd and controlled execution environment, remaining risks are mainly resource/DoS (many pages) and local file output handling.