pdf

Warn

Audited by Runlayer on Feb 21, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
12
Flagged
12
Chunks
14
Flagged Files (12)
LICENSE.txtHIGH
78.3%

Malicious tool definition detected

Tool: LICENSE.txt Description: © 2025 Anthropic, PBC.

SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md Description: --- name: pdf description: Comprehensive PDF manipulation toolkit for extracting text and tables, creating new PDFs, merging/splitting documents, and handling forms.

forms.mdHIGH
78.3%

Malicious tool definition detected

Tool: forms.md [1/2] Description: **CRITICAL: You MUST complete these steps in order. Do not skip ahead to writing code.** If you need to fill out a PDF form, first check to see if the PDF has fillable form fields.

Tool: forms.md [2/2] Description: [left, top, right, bottom].

reference.mdHIGH
78.3%

Malicious tool definition detected

Tool: reference.md [1/2] Description: # PDF Processing Advanced Reference This document contains advanced PDF processing features, detailed examples, and additional libraries not covered in the main skill instructions.

Tool: reference.md [2/2] Description: and compress qpdf --optimize-level=all input.pdf compressed.pdf # Attempt to repair corrupted PDF structure qpdf --check input.pdf qpdf --fix-qdf damaged.pdf repaired.pdf # Show detailed PDF structure for debugging qpdf --show-all-pages input.pdf > structure.txt ``` #### Advanced Encryption ```bash # Add password protection with specific permissions qpdf --encrypt user_pass owner_pass 256 --print=none --modify=none -- input.pdf encrypted.pdf # Check encrypti

scripts/check_bounding_boxes.pyHIGH
78.3%

Malicious tool definition detected

Tool: scripts/check_bounding_boxes.py Description: from dataclasses import dataclass import json import sys # Script to check that the `fields.json` file that Claude creates when analyzing PDFs # does not have overlapping bounding boxes.

scripts/check_bounding_boxes_test.pyHIGH
78.3%

Malicious tool definition detected

Tool: scripts/check_bounding_boxes_test.py Description: import unittest import json import io from check_bounding_boxes import get_bounding_box_messages # Currently this is not run automatically in CI; it's just for documentation and manual checking.

scripts/check_fillable_fields.pyHIGH
78.3%

Malicious tool definition detected

Tool: scripts/check_fillable_fields.py Description: import sys from pypdf import PdfReader # Script for Claude to run to determine whether a PDF has fillable form fields.

scripts/convert_pdf_to_images.pyHIGH
78.3%

Malicious tool definition detected

Tool: scripts/convert_pdf_to_images.py Description: import os import sys from pdf2image import convert_from_path # Converts each page of a PDF to a PNG image.

scripts/create_validation_image.pyHIGH
78.3%

Malicious tool definition detected

Tool: scripts/create_validation_image.py Description: import json import sys from PIL import Image, ImageDraw # Creates "validation" images with rectangles for the bounding box information that # Claude creates when determining where to add text annotations in PDFs.

scripts/extract_form_field_info.pyHIGH
78.3%

Malicious tool definition detected

Tool: scripts/extract_form_field_info.py Description: import json import sys from pypdf import PdfReader # Extracts data for the fillable form fields in a PDF and outputs JSON that # Claude uses to fill the fields.

scripts/fill_fillable_fields.pyHIGH
78.3%

Malicious tool definition detected

Tool: scripts/fill_fillable_fields.py Description: import json import sys from pypdf import PdfReader, PdfWriter from extract_form_field_info import get_field_info # Fills fillable form fields in a PDF.

scripts/fill_pdf_form_with_annotations.pyHIGH
78.3%

Malicious tool definition detected

Tool: scripts/fill_pdf_form_with_annotations.py Description: import json import sys from pypdf import PdfReader, PdfWriter from pypdf.annotations import FreeText # Fills a PDF by adding text annotations defined in `fields.json`.

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
12
Files Flagged
12
Chunks Analyzed
14
Analyzed
Feb 21, 2026, 04:51 PM
Security Audit — runlayer — pdf