Agent Economy ReportAgent Economy ReportSAFE version 0.1.0 · audited 2026-09-09
This package is documentation only: a markdown guide showing how to work with PDF files using common Python libraries (pypdf, pdfplumber, reportlab) and command-line tools (pdftotext, qpdf, pdftk). There are no scripts, no executables, and no code that runs on its own. The only network reference is a link to the publisher's profile page on the registry site. All file operations shown are local reads and writes of PDF/text files in the examples. Two items warrant mild attention: the guide references companion files (forms.md, reference.md) that are not included in the package, and it shows how to remove passwords from encrypted PDFs and install extra Python packages via pip.
| Declared purpose | A PDF manipulation toolkit guide for extracting text and tables, creating PDFs, merging/splitting documents, and filling forms. |
| Observed behavior | Provides static markdown instructions and code snippets. No automatic execution, no credential access, no network calls, no persistence. Any effect occurs only if a user or agent chooses to run the sample code, which reads and writes local PDF, text, and xlsx files. |
| Verdict, rules only | SAFE |
| Verdict, AI | SAFE |
| Final verdict | SAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| filesystem_read | needed | Examples open local PDFs for reading, e.g. SKILL.md line 19 'reader = PdfReader("document.pdf")'. |
| filesystem_write | needed | Examples write output PDFs and spreadsheets locally (SKILL.md lines 42, 52, 75, 247, 272); all destinations are relative local filenames. |
| shell | needed | Bash snippets invoke pdftotext, qpdf, pdftk, pdfimages on local files (SKILL.md lines 172-209, 252-254). No piping of downloaded content into a shell. |
| install_packages | exceeds purpose | SKILL.md line 215 suggests 'pip install pytesseract pdf2image' for OCR; optional and from public PyPI, but it is a package install triggered by following the guide. |
| network | exceeds purpose | Only a documentation link to https://clawhub.ai/user/awspace in skill-card.md line 7. No runtime network activity. |
| severity | finding |
|---|---|
| low | Directs the agent to follow instructions in files not included in the package The guide tells the agent to read and follow forms.md and reference.md, but neither file ships with this package. If those files are supplied later or from elsewhere, their instructions would be followed without having been reviewed here. SKILL.md:11 For advanced features, JavaScript libraries, and detailed examples, see reference.md. If you need to fill out a PDF form, read forms.md and follow its instructi |
| low | Suggests installing additional Python packages Following the OCR example requires installing two public PyPI packages. This is a normal dependency for OCR but means package installation may occur as a side effect of using the skill. SKILL.md:215 # Requires: pip install pytesseract pdf2image |
| info | Documents removal of PDF password protection The guide shows how to decrypt a password-protected PDF using a supplied password. This is standard qpdf usage, not a bypass, but it does involve handling document passwords on the command line where they may appear in shell history. SKILL.md:196 qpdf --password=mypassword --decrypt encrypted.pdf decrypted.pdf |
| info | Only external domain is the registry publisher page The single domain in the package is a documentation link to the publisher's registry profile; no code contacts it. skill-card.md:7 [awspace](https://clawhub.ai/user/awspace) <br> |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| Binaries invoked | bash, pip, python |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 5 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 294 | 38d8559d4899602f… |
_meta.json | 6 | 38f1f4e6c595ecbf… |
skill-card.md | 41 | 5baca9f719bbbc11… |
For agents
JSON: https://agenteconomy.report/k/pdf.audit.json · badge: https://agenteconomy.report/k/pdf.audited.svg ·
skill rating: /k/pdf · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).