html-to-pdf 安全扫描报告 — 可信 | ClawSafe

5 /100

html-to-pdf

Convert HTML files and URLs to PDF using Puppeteer

A legitimate HTML-to-PDF conversion tool using Puppeteer with no malicious behavior, obfuscation, or undeclared capabilities.

技能名称html-to-pdf

分析耗时26.7s

引擎pi

✓

可以安装

This skill is safe to use. No security concerns identified.

安全发现 2 项

严重性	安全发现	位置
低危	Browser resource not declared in SKILL.md 文档欺骗 The skill uses Puppeteer to launch a headless browser, which is a 'browser' resource. This is not explicitly declared in SKILL.md under features or capabilities. `const browser = await puppeteer.launch({ headless: 'new' });` → Add browser:READ to the capability mapping in SKILL.md frontmatter, e.g., 'browser: READ' via Puppeteer.	`scripts/html-to-pdf.js:17`
低危	Dependency puppeteer not version-pinned 供应链 SKILL.md installation instructions use 'npm install puppeteer' without specifying a version, allowing major version updates. `npm install puppeteer` → Pin to a specific version, e.g., 'npm install puppeteer@23' or include a package.json.	`SKILL.md:64`

资源类型	声明权限	推断权限	状态	证据
文件系统	`WRITE`	`WRITE`	✓ 一致	scripts/html-to-pdf.js:36 - path.resolve() for input; writes PDF output
网络访问	`READ`	`READ`	✓ 一致	scripts/html-to-pdf.js:28 - page.goto() for URL conversion; declared in SKILL.md…
命令执行	`NONE`	`NONE`	—	No subprocess, exec, or shell command execution in implementation
环境变量	`NONE`	`NONE`	—	No os.environ access or environment variable iteration
浏览器	`NONE`	`READ`	✓ 一致	scripts/html-to-pdf.js:17 - puppeteer.launch() spawns browser; should be declare…

4 文件 · 7.4 KB · 285 行

Markdown 3f · 217L JavaScript 1f · 68L

├─ ▾ 📁 references

│ ├─ 📝 api.md Markdown 48L · 1.3 KB

│ └─ 📝 setup.md Markdown 79L · 1.9 KB

├─ ▾ 📁 scripts

│ └─ 📜 html-to-pdf.js JavaScript 68L · 2.0 KB

└─ 📝 SKILL.md Markdown 90L · 2.2 KB

包名	版本	来源	已知漏洞	备注
`puppeteer`	`*`	npm	否	Version not pinned in installation instructions

✓ No obfuscation, base64 encoding, or anti-analysis patterns detected

✓ No credential harvesting or sensitive file/path access

✓ No data exfiltration or external IP communication beyond the declared URL conversion feature

✓ No reverse shell, C2, or persistence mechanisms

✓ Code is clean, readable, and straightforward

✓ SKILL.md documentation accurately describes all core capabilities

✓ No hidden instructions or prompt injection vectors

✓ Error handling uses standard practices without suspicious behaviors