md-to-pdf

Pass

Audited by Gen Agent Trust Hub on Feb 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script md_to_pdf.py invokes the system Google Chrome binary (/usr/bin/google-chrome) using subprocess.run. It utilizes standard headless flags such as --print-to-pdf and --screenshot to generate the final output from an intermediate HTML file.
  • [EXTERNAL_DOWNLOADS]: The skill specifies a dependency on the markdown Python package and requires the Google Chrome browser to be pre-installed on the system. These are well-known and trusted tools for document processing.
  • [SAFE]: No malicious patterns such as prompt injection, data exfiltration, or obfuscation were detected. The script performs minimal HTML escaping on frontmatter metadata values before they are injected into the HTML template, providing a basic level of protection against injection into the rendering pipeline.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 23, 2026, 02:36 PM