Pdf Smart Tool Cn

The skill claims local PDF/OCR/signature functionality which reasonably needs pdftotext, tesseract, and ghostscript (listed in SKILL.md metadata). However the registry-level requirements reported no required binaries or environment variables — this mismatch is an incoherence that could hide assumptions about available tooling or runtime behavior.

SKILL.md is an instruction-only spec describing user interactions and examples but is vague about implementation: it does not state where files are stored/processed, whether processing is local or uploaded to external services, nor how sensitive artifacts (private keys, enterprise seals, CA certificates) are supplied or protected. That open-endedness grants broad discretion to any runtime implementation and is a data-exfiltration risk if the agent chooses to upload files.

No install spec and no code files are included (instruction-only). This minimizes disk-write/install risk. The SKILL.md does require certain binaries, but no installer is provided.

No environment variables or credentials are declared, yet features like '数字证书 (CA digital certificate)' and '企业电子签章' imply access to sensitive private keys or enterprise credentials. The skill does not explain how those keys should be provided or protected, which is disproportionate and risky for handling sensitive secrets.

always is false and there is no install/persistence behavior in the package. The skill does not request to modify other skills or system-wide settings.