PR's PDF Agent

Self-hosted PDF operations and conversions with metered usage output.

This package implements a comprehensive self-hosted PDF CLI (merging, splitting, OCR, conversions, redaction, an 'agent' mode) and the code mostly matches that purpose — but pay attention to these issues before running it: - Dependency mismatch: The registry lists no required binaries/env but SKILL.md and code expect many external tools (gs, qpdf, pdftoppm, soffice, ocrmypdf, wkhtmltopdf/Chrome, and optionally ollama). Ensure those are installed intentionally. - Network and external execution: html_to_pdf can fetch remote URLs; core.llm can run arbitrary commands or call 'ollama' (a local LLM runner). Running the CLI with remote sources or LLM provider=command may cause the tool to access the network or execute untrusted commands. Treat any use that passes URLs or enables an external LLM/command as potentially exfiltrative. - Undeclared env usage: The code reads PDFAGENT_SOFFICE_TIMEOUT (and subprocess code supports custom env). Review environment variables and avoid exposing secrets to the runtime environment you use for this tool. - Run in isolation first: Test the tool in a sandbox / disposable VM, with non-sensitive PDFs, and confirm behavior (doctor command reports available binaries). Inspect CLI flags (especially anything enabling LLM/agent mode or remote fetching) before using on private data. - Origin and trust: The source 'homepage' and origin are unknown. If you need to run this in production or on sensitive documents, consider auditing the remaining omitted files, or prefer a vetted implementation from a known source. If you want, I can: (1) list every place the code can perform network I/O or spawn external processes, (2) locate where the CLI accepts LLM provider/command options, or (3) highlight any remaining omitted files for further review.

Type: OpenClaw Skill Name: pdfagent Version: 0.1.0 The skill bundle provides extensive PDF manipulation capabilities but contains high-risk features that could be exploited via prompt injection. Specifically, the 'agent' and 'translate' commands in 'pdfagent/cli.py' allow for arbitrary command execution through the '--llm-cmd' parameter (processed in 'pdfagent/core/llm.py'), which is intended for local LLM integration but lacks sanitization against malicious instructions. Additionally, 'pdfagent/tools/html_to_pdf.py' uses 'urllib.request.urlopen' to fetch content from user-provided URLs, introducing a potential Server-Side Request Forgery (SSRF) risk.