Audited by Socket on Feb 16, 2026
1 alert found:
Malware[Skill Scanner] Installation of third-party script detected BENIGN: The skill description and examples are coherent with a legitimate PDF processing toolset. No malicious data flows, credential harvesting, or external network communication are indicated. Data flows are strictly local file I/O and standard library usage for PDF manipulation. LLM verification: The skill’s described capabilities are appropriate for PDF processing tasks. Primary security concerns are about supply-chain hygiene (unpinned OCR dependency and potential unvetted script installations). Mitigations: pin dependency versions, verify sources, and avoid auto-installation of third-party scripts in production. Overall assessment remains largely benign with important notes on dependency management to reduce risk.