pdf-analysis

Name: pdf-analysis
Availability: InStock
Author: chenchunrun

Detect embedded threats and indicators of compromise in PDF files.

1|1|Updated Apr 25, 2026

Search Tags:#pdf #metadata-extraction #url-analysis #threat-detection #malware-analysis #embedded-files #pdf-security

Ready to run

npx skills add https://github.com/chenchunrun/onyx-soc --skill pdf-analysis

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pdf-analysis
Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/pdf-analysis
Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill pdf-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires PyMuPDF, Pillow, pyzbar, and includes scripts (resource) and references (resource) components.

What problem does it solve?

PDF files often contain malicious scripts, embedded payloads, or unsafe features that are hard to identify manually, leading to security risks.

Core Features & Use Cases

Metadata extraction to identify creator, date, and tools used.
JavaScript/embedded content detection, URL discovery, and CVE indicators.
Text and content extraction for rapid triage and reporting.

Quick Start

Analyze a sample PDF to identify threat indicators and generate a concise security report.

Frequently Asked Questions about pdf-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect malicious JavaScript and embedded files in a PDF?▼

You can detect malicious JavaScript in PDFs by applying robust parsing to extract document metadata, identify embedded content, and report indicators of compromise. This process analyzes JavaScript, embedded files, URLs, and CVE features to uncover hidden threats.

What is the best way to extract metadata and URLs from PDF files for threat intelligence?▼

The best way to extract metadata and URLs for threat intelligence is to parse the PDF structure for creator information, embedded links, and CVE indicators. This generates structured output suitable for SIEM workflows and automated scanning pipelines.

Can I use PyMuPDF and Pillow to analyze PDF security threats in an automated scanning pipeline?▼

Yes, you can analyze PDF security threats in automated scanning pipelines using PyMuPDF, Pillow, and pyzbar. This Skill implements robust parsing and metadata extraction to generate structured output for SIEM integration and incident response.

Does PDF threat detection work with SIEM workflows and incident response reporting?▼

PDF threat detection works with SIEM workflows by generating structured output from parsed metadata, JavaScript, and embedded file analysis. This provides incident responders and threat analysts with concise security reports for rapid triage.

How do I identify CVE indicators and unsafe features in PDF documents?▼

Identifying CVE indicators and unsafe features in PDF documents requires robust parsing to detect JavaScript, embedded payloads, and form data. This Skill reports these threat indicators to support incident response and automated scanning workflows.