nutrient-document-processing
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation describes an alternative setup using npx to download and execute the official @nutrient-sdk/dws-mcp-server package from npm. This is a standard deployment method for the vendor's MCP integration.
- [PROMPT_INJECTION]: The skill's document processing capabilities (OCR and text extraction) create an indirect prompt injection surface where instructions embedded in a processed document could attempt to influence the agent's behavior.
- Ingestion points: User-supplied documents in various formats (PDF, DOCX, etc.) processed via the build API.
- Boundary markers: No explicit instruction delimiters or boundary markers are suggested for handling the extracted text.
- Capability inventory: The skill utilizes network access to api.nutrient.io and local file system access for document management.
- Sanitization: The documentation focuses on functionality; users should ensure they validate or sanitize extracted text if it is used for downstream decision-making.
Audit Metadata