pdf-to-markdown
Warn
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill template interpolates a user-provided file path into a Python string literal. A filename containing characters like quotes and semicolons could escape the string and execute arbitrary Python code when the agent runs the script.- [COMMAND_EXECUTION]: The skill instructs the agent to run a shell command to install the 'pymupdf4llm' package.- [EXTERNAL_DOWNLOADS]: The skill downloads the 'pymupdf4llm' library from the Python Package Index (PyPI). This is a well-known library for document processing.- [COMMAND_EXECUTION]: The skill processes external PDF files and converts them to markdown. It lacks boundary markers to prevent instructions embedded within the PDF from influencing the agent's logic after the conversion process.
Audit Metadata