Nutrient Document Processing Skill
A universal Agent Skill that gives any coding agent PDF generation, conversion, OCR, redaction, signing, archiving and optimization powers via the Nutrient DWS API.
Evidence shows excellent least-privilege and confirmation design: every script embeds a paid-run approval gate (--confirm-external-processing with credit estimate), the key lives only in the environment and is never printed, passwords are read only from chmod-600 files, AI redaction is two-stage with separately approved irreversible apply, outputs are atomic and refuse overwrite, and CI writes tokens to 600-permission temp files. Deducted because external-transfer enforcement relies on the agent following instructions rather than hard technical enforcement, remote-URL inputs carry SSRF-style risk mitigated only by guidance, and there is no sandbox isolation.
Offline contract tests cover page-range parsing, all three typed output shapes, overwrite refusal, secret-file permissions, per-invocation confirmation, --help without a key, and pre-network blocking when confirmation is missing; CI workflows execute them, meeting the static uplift condition. Deducted because real API call paths (DWS 3.1.0 client behavior, failure feedback quality) cannot be statically verified and depend on nutrient-dws==3.1.0 availability and correctness.
The product router cleanly separates Processor / Data Extraction / Accessibility; trigger description and non-fit ranges are explicit; setup and runtime requirements are complete. Deducted because core function depends entirely on the overseas paid Nutrient DWS API (api.nutrient.io) with questionable mainland-China reachability, requires a paid API key, and offers no Chinese-language support notes.
Layered architecture (SKILL.md router plus modular references), MIT-0 license, version 2.0.0, release workflow with changelog and pinned source commit, human publication gates. Deducted because publisher is unverified, maintenance responsibility and update path are only implicit in repo structure, and the testing guide is a manual procedure rather than automated user-facing validation.
The skill covers core document-processing scenarios; the pinned typed client reduces hand-written-payload errors, and safe output writers plus the approval gate should yield directly usable artifacts. Deducted because static review cannot verify real output correctness/completeness, value depends on a paid API (cost/benefit scales with usage), and README marketing demos are not independently checkable.
Real CI workflows plus committed test suites covering key paths (subprocess-level blocking tests, payload fixture comparison, absence of unsafe raw payloads) exceed claim-only evidence. Deducted because this is a static read without execution, tests cover only offline contracts and source structure, and real API behavior plus third-party corroboration are missing.
- Core function depends entirely on the overseas paid api.nutrient.io service; mainland-China reachability is unverified, and a paid API key with credit consumption is required
- Remote-URL inputs make Nutrient's server fetch the URL — guard against internal-network addresses; manually verify transferred files and credit estimates before every paid run
- All safety rules (approval gate, two-stage redaction, key hygiene) rely on the agent following instructions with no technical sandbox; use only in a trusted agent environment
- Publisher is unverified; this is a static source review with no executed API calls — real conversion/signing/redaction output quality is unverified
What does this skill do, and when should you use it?
This is the official open-source Agent Skill from Nutrient (formerly PSPDFKit), giving 40+ AI coding agents (Claude Code, Codex CLI, Gemini CLI, Cursor, and more) document-processing capabilities through the Nutrient DWS cloud API. It ships a set of single-operation Python scripts plus a multi-step workflow template covering conversion, merge/split, OCR, text/table extraction, redaction, watermarking, digital signing, form filling, and PDF/A & PDF/UA compliance output. Security is a first-class concern: every paid call requires showing the operation and credit estimate and getting explicit user approval, keys flow only through environment variables, and redaction follows a two-stage stage-then-apply flow. You need a Nutrient account, Python 3.10+, and uv, and the API is a paid cloud service.
The skill consists of SKILL.md instructions, single-operation Python scripts under scripts/ (pinned via PEP 723 metadata to the nutrient-dws==3.1.0 typed client), and the assets/templates/custom-workflow-template.py for multi-step jobs. At runtime the agent reads local files or remote URLs and calls the Nutrient DWS Processor API with NUTRIENT_API_KEY to: convert formats (PDF, PDF/A, PDF/UA, DOCX, XLSX, PPTX, PNG, JPEG, WebP, HTML, Markdown); merge/split/add/delete/duplicate/rotate pages; OCR and extract text, tables, and key-value pairs; apply text watermarks; optimize; stage AI-assisted redactions (annotations reviewed before a separately approved irreversible apply); apply CMS/CAdES digital signatures; and password-protect files (passwords read only from chmod 600 local files, never argv). All outputs are written atomically with owner-only permissions and refuse to overwrite existing paths.
- Legal/compliance staff sharing a PII-containing PDF: have the agent stage redactions with redact-ai.py, visually review each match, then separately approve the irreversible apply
- Developers batch-converting Office files: use convert.py to turn DOCX/XLSX/PPTX into PDF or PDF/A archival output
- Users with scanned documents: run ocr.py to produce a searchable PDF, then extract-text.py for the text layer
- HR/onboarding flows: fill an employee form PDF from Instant JSON or XFDF data, then digitally sign it with sign.py (CMS)
- Advanced users needing precise multi-step pipelines (fill, redact, optimize, then sign): copy custom-workflow-template.py to a task-specific temp path and customize it
- Publishers optimizing for web delivery: linearize PDFs with optimize.py for fast viewing
What are this skill's strengths and limitations?
- Works across 40+ Agent Skills-compatible agents from a single install
- Broad coverage: conversion, OCR, redaction, signing, compliance output, form filling in one skill
- Thoughtful safety design: key isolation, paid-run approval gate, two-stage redaction, atomic non-overwriting writes
- Pinned dependency (nutrient-dws==3.1.0) with a typed client reduces API drift risk
- MIT-0 licensed, with modular reference docs and a custom workflow template
- Depends on the paid Nutrient DWS cloud API — files are uploaded to a third party, credits are consumed per run, and pricing is not documented in the repo
- Requires NUTRIENT_API_KEY configuration plus uv and Python 3.10+, an environment barrier for casual use
- Repo-level license is listed as unknown in GitHub metadata (SKILL.md and LICENSE.txt say MIT-0) — verify for enterprise compliance review
- Signature trust chains and PDF/A, PDF/UA conformance must be independently validated by the user
- The repo provides a manual testing guide rather than an automated test suite
How do you install this skill?
Recommended: npx skills add PSPDFKit-labs/nutrient-agent-skill — optionally with -a claude-code -a codex -a cursor for specific agents or -g for global install. Manual: git clone https://github.com/PSPDFKit-labs/nutrient-agent-skill.git, then copy the nutrient-document-processing/ folder into your agent's skills directory (e.g. ~/.claude/skills/ for Claude Code, ~/.cursor/skills/ for Cursor). Prerequisites: Python 3.10+, uv (https://docs.astral.sh/uv/), and a Processor API key from https://dashboard.nutrient.io/sign_up/?product=processor configured as NUTRIENT_API_KEY via your environment or secrets manager (never paste it into chat or command arguments).
How do you use this skill?
After installing, trigger it with natural language, e.g. "Extract the text from invoice.pdf", "OCR scanned-contract.pdf in English and extract the text", or "Digitally sign contract.pdf". Before each paid run the agent shows the exact operation, transferred files, and credit estimate, then waits for approval; the script runs via uv run and requires both --estimated-credits and --confirm-external-processing flags. Approval never carries over to retries or batches. Page ranges are zero-based and inclusive (0:4 means five pages). Multi-step jobs require copying the workflow template to a task-specific temporary path per SKILL.md. Note: credit pricing details are not documented in the repository; check the Nutrient dashboard.
How does this skill compare with similar options?
For similar document-processing needs, alternatives include Nutrient's own @nutrient-sdk/dws-mcp-server (the MCP server form on npm) or calling the DWS REST API directly; this skill's edge is no MCP setup, universal support across 40+ agents, and built-in approval gates and safety constraints.