Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Audit PDF files for metadata leakage, page count, encryption, JavaScript, embedded files, and version. Use before sending a PDF externally, when redacting sensitive metadata, or running a PDF security review.
.claude/skills/borghei-pdf-toolkit/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-01 | ✗→✓ | ▲ Improved | 245% | 0% |
| case-05 | ✗→✓ | ▲ Improved | 114% | 0% |
| case-08 | ✗→✓ | ▲ Improved | 49% | 0% |
| case-14 | ✗→✓ | ▲ Improved | 12% | 0% |
| case-17 | ✗→✓ | ▲ Improved | 44% | 0% |
Audit .pdf files for metadata, page count, encryption status, embedded JavaScript, embedded files, and PDF version — using the standard library only.
pdf, pdf audit, pdf metadata, pdf review, pdf leakage, pdf security, redaction, document handoff
Before running the audit, confirm these inputs. If any is unknown or vague, ASK — do not assume:
Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.
bashpython scripts/pdf_auditor.py contract.pdf
Outputs: PDF version, page count, file size, metadata (Author, Title, Producer, Creator, dates), encryption status, embedded JavaScript indicators, embedded file indicators.
Goal: Stop leaking author identity, prior client names, or document history when handing a PDF to an external party.
Steps:
python scripts/pdf_auditor.py document.pdfAuthor matches the sender (not "Bob's intern" from a prior project)Title matches the document, not a leftover working titleProducer doesn't reveal an internal-only PDF toolCreationDate and ModDate are reasonable for the dealTime Estimate: 2-3 minutes per document.
Goal: Decide whether a received PDF can be opened safely on a managed laptop.
Steps:
Time Estimate: 1-2 minutes per inbound document.
Goal: Audit every PDF in a folder before zipping for a customer or partner.
Steps:
for f in *.pdf; do python scripts/pdf_auditor.py "$f" --json; done > audit.jsonlTime Estimate: 1-2 minutes per file.
Reads a PDF using stdlib parsing — no pypdf or pdfplumber required. Detects:
/Type /Page object scan)/Encrypt reference present)/JS, /JavaScript, /AA keys)/EmbeddedFiles)bashpython scripts/pdf_auditor.py document.pdf python scripts/pdf_auditor.py document.pdf --json
Limits:
pdfplumber or pypdf separately.references/pdf_handoff_guide.md — What to scrub from PDFs before external send; PDF/A and PDF/UA basics; common leakage patternsassets/pdf_handoff_checklist.md — Pre-send PDF sign-off checklistPublic-Report.pdf can carry private metadata indistinguishable to the human eye.legal/ for redacted contract handoffsc-level-advisor/board-deck-builder for board pack handoffmarketing/ for whitepaper / case-study handoff| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-09 | pass→pass | 10,515 | 7,613 | -28% | 1 | 1 | 0% | 1,677 | 2,389 | +42% | 0 | 0 | — |
case-10 | pass→pass | 9,286 | 9,516 | +2% | 1 | 1 | 0% | 1,537 | 2,754 | +79% | 0 | 0 | — |
case-03 | fail→fail | 9,132 | 17,056 | +87% | 1 | 1 | 0% | 1,484 | 4,409 | +197% | 0 | 0 | — |
case-01 | fail→pass | 9,965 | 20,499 | +106% | 1 | 1 | 0% | 1,541 | 5,309 | +245% | 0 | 0 | — |
case-02 | fail→fail | 8,477 | 19,528 | +130% | 1 | 1 | 0% | 1,353 | 4,724 | +249% | 0 | 0 | — |
case-04 | fail→fail | 13,568 | 13,732 | +1% | 1 | 1 | 0% | 2,193 | 3,707 | +69% | 0 | 0 | — |
case-05 | fail→pass | 13,143 | 15,715 | +20% | 1 | 1 | 0% | 1,862 | 3,991 | +114% | 0 | 0 | — |
case-06 | pass→pass | 9,209 | 6,881 | -25% | 1 | 1 | 0% | 1,302 | 2,232 | +71% | 0 | 0 | — |
case-07 | pass→pass | 10,791 | 7,628 | -29% | 1 | 1 | 0% | 1,653 | 2,378 | +44% | 0 | 0 | — |
case-08 | fail→pass | 11,422 | 7,899 | -31% | 1 | 1 | 0% | 1,599 | 2,387 | +49% | 0 | 0 | — |
case-11 | fail→fail | 11,966 | 14,025 | +17% | 1 | 1 | 0% | 1,810 | 3,401 | +88% | 0 | 0 | — |
case-12 | fail→fail | 20,472 | 4,909 | -76% | 1 | 1 | 0% | 1,155 | 2,155 | +87% | 0 | 0 | — |
case-13 | pass→pass | 10,128 | 7,832 | -23% | 1 | 1 | 0% | 1,682 | 2,351 | +40% | 0 | 0 | — |
case-14 | fail→pass | 11,812 | 5,138 | -57% | 1 | 1 | 0% | 1,938 | 2,170 | +12% | 0 | 0 | — |
case-15 | pass→pass | 10,427 | 8,210 | -21% | 1 | 1 | 0% | 1,622 | 2,447 | +51% | 0 | 0 | — |
case-16 | pass→pass | 17,644 | 13,680 | -22% | 1 | 1 | 0% | 2,695 | 3,525 | +31% | 0 | 0 | — |
case-17 | fail→pass | 14,685 | 12,427 | -15% | 1 | 1 | 0% | 2,173 | 3,135 | +44% | 0 | 0 | — |
case-18 | fail→pass | 10,053 | 4,638 | -54% | 1 | 1 | 0% | 1,484 | 1,974 | +33% | 0 | 0 | — |
case-19 | pass→pass | 11,140 | 7,182 | -36% | 1 | 1 | 0% | 1,745 | 2,470 | +42% | 0 | 0 | — |
case-20 | pass→pass | 6,722 | 7,045 | +5% | 1 | 1 | 0% | 1,335 | 2,577 | +93% | 0 | 0 | — |
case-21 | pass→pass | 7,505 | 5,788 | -23% | 1 | 1 | 0% | 1,471 | 2,322 | +58% | 0 | 0 | — |
case-22 | pass→pass | 8,260 | 6,425 | -22% | 1 | 1 | 0% | 1,553 | 2,377 | +53% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 21 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +27 percentage points is the difference between those two pass rates over the 21 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.