# compress-pdf

[github.com/openclaw/skills](https://github.com/openclaw/skills)

## Trust Assessment

compress-pdf received a trust score of 69/100, placing it in the **Caution** category. This skill has some security considerations that users should review before deployment.

SkillShield's automated analysis identified 5 findings: 0 critical, 1 high, 2 medium, and 1 low severity. Key findings include Suspicious import: requests, Potential data exfiltration: file read + network send, Unpinned Python dependency version.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

### Layer Breakdown

| Layer                         | Score |
|-------------------------------|-------|
| Manifest Analysis             | 100%  |
| Static Code Analysis          | 78%   |
| Dependency Graph              | 93%   |
| LLM Behavioral Safety         | 98%   |

## Behavioral Risk Signals

- **Network Access**: 4 findings  
- **Filesystem Write**: 1 finding  
- **Excessive Permissions**: 1 finding

## Security Findings 5

| Severity | Finding                                                                                                                                                                                                             | Layer      | Location                                                             |
|----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|---------------------------------------------------------------------|
| HIGH     | Potential data exfiltration: file read + network send<br>Function 'create_job' reads files and sends data over the network. This may indicate data exfiltration.<br>Review this function to ensure file contents are not sent to external servers. | Static     | skills/crossservicesolutions/compress-pdf/scripts/compress-pdf.py:58 |
| MEDIUM   | Suspicious import: requests<br>Import of 'requests' detected. This module provides network or low-level system access.<br>Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.               | Static     | skills/crossservicesolutions/compress-pdf/scripts/compress-pdf.py:24 |
| MEDIUM   | Unpinned Python dependency version<br>Requirement 'requests>=2.32.0' is not pinned to an exact version.<br>Pin Python dependencies with '==<exact version>'.                                                                 | Dependencies | skills/crossservicesolutions/compress-pdf/requirements.txt:1        |
| LOW     | Loosely pinned dependency 'requests'<br>The 'requests' library is pinned with a minimum version (`requests>=2.32.0`) rather than an exact version (`requests==2.32.0`). Best practice for production environments is often to pin exact versions to ensure deterministic builds and prevent unexpected behavior.      | LLM        | requirements.txt:1                                                 |
| INFO    | Suspicious provider name/domain 'XSS'<br>The provider name 'Cross-Service-Solutions (XSS)' and its domain use the acronym 'XSS', which could be seen as a social engineering tactic. Investigate the legitimacy of the provider.                                   | LLM        | SKILL.md:1                                                         |

## Scan History

### Scan History

Score Trend

| Date       | Score |
|------------|-------|
| 3 months ago | 71    |
| 3 months ago | 71    |
| 3 months ago | 71    |
| 3 months ago | 71    |
| 3 months ago | 71    |
| 3 months ago | 71    |
| 3 months ago | 71    |
| 3 months ago | 71    |
| 3 months ago | 71    |
| 3 months ago | 71    |
| Latest     | 69    |

### Embed Code

Markdown

```

```