adobe-create-pdfs-from-data

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external, potentially untrusted data files (CSV/TSV) and document templates (PDF/INDD) to perform automated layout merges.
  • Ingestion points: Untrusted content enters the agent context via dataUrl, originalPdfUrl, and inddUrl inputs provided by the user.
  • Boundary markers: The skill implements mandatory "Gates," specifically Gate 2, which requires the agent to present LLM-generated mapping JSON to the user and wait for explicit approval before proceeding with template modification.
  • Capability inventory: The skill possesses the capability to read/write local PDF files using PyMuPDF, perform network uploads/downloads via Adobe asset tools, and execute remote InDesign merge operations.
  • Sanitization: The workflow includes a validation step for the LLM-generated mapping JSON to filter out potential hallucinations or errors before the user approval gate.
  • [COMMAND_EXECUTION]: The skill uses the PyMuPDF (fitz) library to perform file system operations, specifically extracting individual pages from a PDF and saving them to a local file (template-condensed.pdf) for further processing.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves document templates, data files, and image assets from user-provided URLs and Adobe's presigned storage URLs to facilitate the merge pipeline.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 01:29 PM