Opens a PDF or Office file you don't trust in a V2Mac mini VM, not on your Mac. Drop the file on the app's icon or use Open With: the app gets a read-only copy of only that file and no network. With the optional Shared permission you can also pick files in the mini VM's Shared folder (~/V2Mac Sandbox/<Mini VM>/Shared). Debian supplies and updates Evince and LibreOffice. Macros, active content and link updates are locked off.
It doesn't make a bad file harmless. A successful attack is kept away from your Mac's other files and its IP, but with Shared it can read and change that mini VM's Shared folder and send data through its exit. Without Shared it sees only the file you opened, with no network. If you grant Shared, use a mini VM just for this and keep only the files you want to view there.
Build: Scripts/package.sh . "$(cat base.txt)" <url prefix>. Release: push a v* tag. Built from v2mac-plugin-template. Licence: 0BSD.