Unangbangkay

well the first thing to do is take a quick look at it in the terminal. check the version number and required extensions from the metadata at the top, and look to see how many tables of contents it has (they're appended to the end with each update, like tree rings) to get a sense of its history and anything else unusual

then run forensic audit tools to check for any embedded javascript or advertising tracking features. there is no fully rigorous way to do this since there are always new threats and new obfuscation techniques, it's both an art and a science

once you've satisfied your personal standards that it's secure, go ahead and use the free software viewing program of your choice (no commercial code or what's the point in being careful in the first place?). we like Okular.

idk