netresearch / markdown-to-pdf-skill

v1.4.2 2026-08-27 07:34 UTC

Requires

• netresearch/composer-agent-skill-plugin: *

(MIT AND CC-BY-SA-4.0)

• Netresearch DTT GmbH

Published on Packagist.org on 2026-10-18 10:13 UTC

README

markdown-to-pdf-skill

Convert Markdown files to styled PDFs using WeasyPrint and the Python markdown library. Generic, brand-neutral default; CSS-overridable for branded output.

🔌 Compatibility

Agent Skill following the open standard. Works with Claude Code, Cursor, GitHub Copilot, and any skills-compatible AI agent.

Installation

Via Claude Code Marketplace

/plugin install markdown-to-pdf@netresearch-claude-code-marketplace

Via Composer

composer require netresearch/markdown-to-pdf-skill

npm (Node Projects)

npm install --save-dev \
  @netresearch/agent-skill-coordinator \
  github:netresearch/markdown-to-pdf-skill

Requires @netresearch/agent-skill-coordinator, which discovers the skill in node_modules and registers it in AGENTS.md via a postinstall hook. For pnpm, also allowlist the coordinator's postinstall:

{
  "pnpm": {
    "onlyBuiltDependencies": ["@netresearch/agent-skill-coordinator"]
  }
}

Manual

Clone and place under your agent's skills directory.

Usage

uv run "${SKILL_DIR}/skills/markdown-to-pdf/scripts/convert.py" \
  README.md RFC-001.md -o build/pdfs/

The Python dependencies (markdown, weasyprint) are declared as inline script metadata at the top of convert.py; uv run installs them. WeasyPrint also needs the Pango system libraries (installation notes).

Pass --css path/to/your.css to apply your own brand stylesheet (logo, colours, fonts, headers). The shipped assets/style.css is intentionally neutral.

Images, stylesheets and fonts are loaded only over https: and data: URLs. A reference to any other scheme (http:, file:, ftp:) stops the conversion unless that scheme is allowed with --allow-scheme <scheme>.

Branded output

Netresearch users: install netresearch-branding-skill alongside this one and pass its assets/markdown-pdf.css via --css.

Security

docs/SECURITY-ASSURANCE.md describes the trust boundaries, which resources a conversion may load, the checks that enforce this, and what you cannot expect from the converter. Report vulnerabilities as described in the organisation's security policy.

Dependencies

• Python packages: markdown and weasyprint, declared with lower bounds in the inline script metadata of skills/markdown-to-pdf/scripts/convert.py. uv run installs them from PyPI into a cached environment; there is no lock file.
• System libraries: WeasyPrint needs Pango. .github/workflows/smoke-test.yml installs it with apt-get before running tests/convert.sh.
• Tooling: GitHub Actions (pinned by commit SHA) and pre-commit hooks (pinned by rev) are updated by Renovate (renovate.json).

Governance and policies

• Governance: who decides, how changes are accepted and how disputes are resolved.
• Roadmap: planned and excluded work for the coming year.
• Handling of dependency and code analysis findings: thresholds, deadlines and exceptions for vulnerability and static-analysis findings.
• Secret management: how CI and release credentials are stored, accessed and rotated.
• Access roster: who holds admin and write access to this repository.

Checks that run on every pull request here: Skill Validation (lint.yml: skill structure, markdownlint, yamllint, actionlint, JSON syntax, ShellCheck at style, ruff), Eval Validation (eval-validate.yml), Harness Verification (harness-verify.yml: AGENTS.md exists, has at most 150 lines and links only to existing files), the convert.py smoke test (smoke-test.yml), Security (security.yml: Betterleaks secret scanning, zizmor on the workflow files, Dependency Review, and Composer Audit with Opengrep through netresearch/typo3-ci-workflows; the organisation rule sets what fails a pull request), Template drift (check-template-drift.yml: fails when a file governed by the skill template of netresearch/.github differs from it; .github/template.yaml records the template and the intentional drift, lint.yml and release.yml), and CodeQL analysis of the Python and GitHub Actions code, SonarCloud, the DCO sign-off check and the CodeRabbit review status, which are configured outside this repository's workflows. labeler.yml labels pull requests from .github/labeler.yml, and for dependency-update pull requests, auto-merge (auto-merge-deps.yml) also runs. The OpenSSF Scorecard workflow (scorecard.yml) runs on pushes to main and master and weekly, not on pull requests.

License

Code: MIT. Documentation/content: CC-BY-SA-4.0. See LICENSE-MIT and LICENSE-CC-BY-SA-4.0.