Demo verdict. This skill and its findings are illustrative data from our product demo, not a real detonation. Real verdicts are on the leaderboard.

Skills/skills.sh/pdf-tools-pro

pdf-tools-pro@0.9.2

CAUTION

Publisher claims: "PDF extraction, merge and OCR." Observed in sandbox:

Registry skills.shPublisher docforge · joined 142 days agoInstalls 241KLast detonated 47 h ago

Dispute verdict

Behavior trace

Honeypot run · 41 s · 3 scenarios

t+CategoryObserved action

0.3spromptSKILL.md parsed · 0 hidden instructions

2.4snetworkPOST https://api.pdf.co/v1/pdf/convert · declared

3.1sfilesystemread ~/Downloads/*.pdf beyond project scope

4.0sprocessinstalls pdf-lib at a floating version

41sclaimedExtracted text and merged two PDFs in the decoy project. Matches README.

Static findings

MEDIUM

Reads outside project scopetask scenario · reads ~/Downloads/*

B-FS01

LOW

Unpinned dependencyscripts/setup.sh · pdf-lib@* (unpinned)

AST07