Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied PDF files, which represents an indirect prompt injection surface where embedded text or metadata could influence agent behavior.
- Ingestion points: PDF content is ingested through libraries like
pypdf,pdfplumber, and CLI tools likepdftotext(referenced inSKILL.md,forms.md, andreference.md). - Boundary markers: The instructions do not specify explicit delimiters or warnings for the agent to ignore instructions embedded within the extracted PDF text.
- Capability inventory: The skill allows file creation and modification (
pypdf,reportlab), image processing (PIL), and command execution (magick,pdftotext,qpdf). - Sanitization: No specific sanitization or filtering of the extracted text content is implemented before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill instructs the agent to use external command-line utilities such as
magick(ImageMagick),pdftotext,qpdf, andpdftkfor image cropping, text extraction, and PDF manipulation. - [DYNAMIC_EXECUTION]: The script
scripts/fill_fillable_fields.pyuses runtime monkeypatching to modify theDictionaryObject.get_inheritedmethod of thepypdflibrary. This is a targeted modification to ensure correct handling of inherited form field attributes during the filling process.
Audit Metadata