visa-doc-translate

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill generates and executes Python scripts using PIL and reportlab to assemble PDFs. It also uses the system-level sips utility for converting HEIC images to PNG.
  • [EXTERNAL_DOWNLOADS]: Instructions include the installation of various common libraries such as easyocr, pytesseract, reportlab, and pillow. These are retrieved from standard registries but represent external dependencies required for the skill's functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes text extracted via OCR from user-provided documents. There is a risk that malicious instructions hidden within a document (e.g., a fake bank statement) could be interpreted by the AI during the translation or script generation phase.
  • Ingestion points: OCR-extracted text from image files provided by the user (as described in SKILL.md).
  • Boundary markers: None. The instructions do not provide delimiters or context isolation for the extracted text.
  • Capability inventory: Subprocess execution for sips, package installation via pip, and dynamic execution of agent-generated Python scripts.
  • Sanitization: None. The skill does not specify any validation or filtering of the text extracted from documents before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 02:04 AM
Security Audit — agent-trust-hub — visa-doc-translate