Report 01M7E3YVF31YQCQ4FHE90VCRTW · checks-v2
document-processor-api skill: automated checks
What HostedMCP checked on 14 Nov 2026, 22:48 UTC. Every result links to the public source it came from, so you can check it yourself.
7 of 7 checks ran · 0 high findings · not a security audit
- Checked
- 14 Nov 2026, 22:48 UTC
- Files read
- SKILL.md and scripts
- Methodology
- checks-v2
What to fix for a higher score
One check can earn more points. The next scan runs within a week, or right after the repository changes.
- No download-and-run or credential theft in scripts up to +21 pts
Ship readable source, not compiled files, and remove from the script named above what made it fail: downloading and running code, running decoded or remote content, or reading credentials and sending them out. When more than five scripts exist, the ones not read earn nothing.
Origin
25 / 25 points- PassSource repository linked and reachable10 pts
pspdfkit-labs/nutrient-skills/plugins/nutrient-dws/skills/document-processor-api is public and reachable
github.com/pspdfkit-labs/nutrient-skills/tree/HEAD/plugins/nutrient-dw ↗ - Pass
- PassCommit or release in the last year5 pts
Last commit 2026-11-03
github.com/pspdfkit-labs/nutrient-skills/commits ↗
Scripts
9 / 30 points- PartialNo download-and-run or credential theft in scripts9 / 30 pts
5 of 17 scripts read; none of them downloads and runs code, the rest were not read
How to fix: Ship readable source, not compiled files, and remove from the script named above what made it fail: downloading and running code, running decoded or remote content, or reading credentials and sending them out. When more than five scripts exist, the ones not read earn nothing.
Instructions to the agent
30 / 30 points- PassNo hidden instructions in SKILL.md20 pts
No override phrases, safeguard switches, credential requests or hidden characters
github.com/pspdfkit-labs/nutrient-skills/blob/HEAD/plugins/nutrient-dw ↗ - PassPre-approved tools are scoped10 pts
No pre-approved tools; the agent asks before using one
github.com/pspdfkit-labs/nutrient-skills/blob/HEAD/plugins/nutrient-dw ↗
Format
15 / 15 points- PassSKILL.md follows the Agent Skills format15 pts
Valid name and description; says when to use it; 131 lines
github.com/pspdfkit-labs/nutrient-skills/blob/HEAD/plugins/nutrient-dw ↗
What these checks do not cover
- Scripts are read, never run. Their logic is not audited, and up to five scripts per skill are read.
- Results describe the skill folder on the date above; a later commit can differ.
- A pass is not a guarantee of safety. Read the scripts before you let an agent run them, and keep allowed-tools narrow.