What to look for
PDFs can carry JavaScript and actions that run when the file opens (an “OpenAction”), and can contain other files as attachments. Most are harmless (form calculations, a cover letter attached to a filing), but a PDF from an unknown sender that runs scripts on open or carries an executable attachment deserves suspicion.
This inspector reads the file structure with pdf-lib; it never executes the scripts it finds. It also lists fonts (and whether they are embedded), every image with its size, the PDF version, encryption, and whether the file was saved incrementally (edits appended to the end, which can leave earlier versions of content inside).
Steps
- Drop the PDF (it is read, never run).
- Check scripts, actions and attachments first.
- Browse fonts, images and metadata.
- Follow the fix links where something needs removing.
Limits, stated plainly
- This is a structural inspection, not an antivirus scan.
Engine: pdf-lib in a Web Worker (structure only; nothing is executed). Your file is not uploaded; check it yourself.