PDF Editor edits and organizes PDF pages with merge, insert, reorder, exchange, and crop operations, built on ComPDF page management capabilities for fast PD...
Security Analysis
high confidenceThe skill's requirements and instructions are coherent with its stated purpose (it downloads a vendor CLI, activates a trial license with an email, and runs that binary to edit PDFs).
The skill claims PDF editing/organization and explicitly downloads and runs a ComPDFKit CLI to perform those tasks. Requesting curl and a one-time license activation via the vendor are consistent with this purpose; there are no unrelated credentials or binaries requested.
SKILL.md instructs the agent to auto-detect platform, download a platform-specific CLI archive from download.compdf.com, extract it into the skill's scripts directory, make the binary executable (mac), and run commands. It also instructs asking the user for an email to obtain a trial license and POST that to the vendor license API. These steps are within the scope of installing and using a third-party CLI, but they involve writing binaries to disk and network calls — the user should be informed and consent to the download and license activation (which the SKILL.md does instruct).
There is no packaged binary included; the agent will download zip archives from https://download.compdf.com and extract them into {skill_root}/scripts/. Using the vendor's domain is appropriate, but download+extract of binaries is inherently higher-risk than instruction-only skills because it executes code fetched at runtime. This is proportionate to the stated need but worth user awareness.
No environment credentials are requested. The only environment access noted is platform detection (env.platform or uname), which is reasonable. The only personal data the skill asks to transmit is the user's email for license activation, which is described in the instructions.
The skill is not always-enabled and does not request elevated agent privileges. It writes its own CLI and license files to its skill directory on first use, which is expected for a skill that bundles or fetches a third-party binary.
Guidance
This skill appears internally consistent: it will download a ComPDFKit CLI from download.compdf.com, extract and run it, and send your email (with your confirmation) to the vendor's license API to obtain a trial license. Before installing, confirm you trust compdf.com and are comfortable with the agent downloading and executing a binary. If you're unsure, run the skill in a sandboxed environment or inspect the downloaded archive manually. The skill does not request unrelated credentials, but be aware it will write files under the skill directory and make network requests to the vendor. Refuse or stop the operation if the download URL or license endpoint differs from the vendor domain shown in SKILL.md.
Latest Release
v1.1.0
- Skill description updated to focus on PDF page management: merge, insert, reorder, exchange, and crop operations. - New examples in the description clarify supported queries such as merging, inserting, and rearranging PDF pages. - Previous references to document comparison, watermark management, and text analysis removed from the skill description. - Command reference, installation, activation, and options remain unchanged.
Popular Skills
Published by @compdf-youna on ClawHub
