Audited by Socket on Feb 15, 2026
1 alert found:
Malware[Skill Scanner] Installation of third-party script detected The fragment is coherently aligned with its stated purpose as a PDF processing toolkit. It provides plausible, well-known usage examples for legitimate document processing tasks with no evident malicious behavior, credential harvesting, or data exfiltration patterns. The only potential risk relates to dependency on external tools and libraries, but this is standard for such a toolkit and not inherently harmful when used as documented. LLM verification: The skill’s described capabilities are appropriate for PDF processing tasks. Primary security concerns are about supply-chain hygiene (unpinned OCR dependency and potential unvetted script installations). Mitigations: pin dependency versions, verify sources, and avoid auto-installation of third-party scripts in production. Overall assessment remains largely benign with important notes on dependency management to reduce risk.