netresearch / markdown-to-pdf-skill

v2.0.1 2026-11-04 12:46 UTC

Requires

• netresearch/composer-agent-skill-plugin: *

(MIT AND CC-BY-SA-4.0)

• Netresearch DTT GmbH

Published on Packagist.org on 2026-11-04 13:10 UTC

README

markdown-to-pdf-skill

Convert Markdown files to styled PDFs using WeasyPrint and the Python markdown library. Generic, brand-neutral default; CSS-overridable for branded output.

🔌 Compatibility

Agent Skill following the open standard. Works with Claude Code, Cursor, GitHub Copilot, and any skills-compatible AI agent.

Installation

Via Claude Code Marketplace

/plugin install markdown-to-pdf@netresearch-claude-code-marketplace

Via Composer

composer require netresearch/markdown-to-pdf-skill

npm (Node Projects)

npm install --save-dev \
  @netresearch/agent-skill-coordinator \
  github:netresearch/markdown-to-pdf-skill

Requires @netresearch/agent-skill-coordinator, which discovers the skill in node_modules and registers it in AGENTS.md via a postinstall hook. For pnpm, also allowlist the coordinator's postinstall:

{
  "pnpm": {
    "onlyBuiltDependencies": ["@netresearch/agent-skill-coordinator"]
  }
}

Manual

Clone and place under your agent's skills directory.

Usage

uv run "${SKILL_DIR}/skills/markdown-to-pdf/scripts/convert.py" \
  README.md RFC-001.md -o build/pdfs/

The Python dependencies (markdown, weasyprint) are declared as inline script metadata at the top of convert.py; uv run installs them. WeasyPrint also needs the Pango system libraries (installation notes).

Pass --css path/to/your.css to apply your own brand stylesheet (logo, colours, fonts, headers). The shipped assets/style.css is intentionally neutral.

Images, stylesheets and fonts are loaded only over https: and data: URLs. A reference to any other scheme (http:, file:, ftp:) stops the conversion unless that scheme is allowed with --allow-scheme <scheme>.

Branded output

Netresearch users: install netresearch-branding-skill alongside this one and pass its assets/markdown-pdf.css via --css.

Security

docs/SECURITY-ASSURANCE.md describes the trust boundaries, which resources a conversion may load, the checks that enforce this, and what you cannot expect from the converter. Report vulnerabilities as described in the organisation's security policy.

Dependencies

• Python packages: markdown and weasyprint, declared with lower bounds in the inline script metadata of skills/markdown-to-pdf/scripts/convert.py. uv run installs them from PyPI into a cached environment; there is no lock file.
• System libraries: WeasyPrint needs Pango. .github/workflows/smoke-test.yml installs it with apt-get before running tests/convert.sh.
• Tooling: GitHub Actions (pinned by commit SHA) and pre-commit hooks (pinned by rev) are updated by Renovate (renovate.json).

Governance and policies

• Governance: who decides, how changes are accepted and how disputes are resolved.
• Roadmap: planned and excluded work for the coming year.
• Handling of dependency and code analysis findings: thresholds, deadlines and exceptions for vulnerability and static-analysis findings.
• Secret management: how CI and release credentials are stored, accessed and rotated.
• Access roster: who holds admin and write access to this repository.

Checks that run on every pull request here: Skill Validation (lint.yml: skill structure, markdownlint, yamllint, actionlint, JSON syntax, ShellCheck at style, ruff), Eval Validation (eval-validate.yml), Harness Verification (harness-verify.yml: AGENTS.md exists, has at most 150 lines and links only to existing files), the convert.py smoke test (smoke-test.yml), Security (security.yml: Betterleaks secret scanning, zizmor on the workflow files, Dependency Review, Composer Audit with Opengrep through netresearch/typo3-ci-workflows, and CodeQL analysis of the Python and GitHub Actions code; the organisation rule sets what fails a pull request), Template drift (check-template-drift.yml: fails when a file governed by the skill template of netresearch/.github differs from it; .github/template.yaml records the template and the intentional drift, lint.yml and release.yml), and SonarCloud, the DCO sign-off check and the CodeRabbit review status, which are configured outside this repository's workflows. Security, Harness Verification and Template drift run only on pull requests to main or master. labeler.yml labels pull requests from .github/labeler.yml, and for dependency-update pull requests, auto-merge (auto-merge-deps.yml) also runs. The OpenSSF Scorecard workflow (scorecard.yml) runs on pushes to main and master and weekly, not on pull requests.

License

Code: MIT. Documentation/content: CC-BY-SA-4.0. See LICENSE-MIT and LICENSE-CC-BY-SA-4.0.