visa-doc-translate
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and executes Python scripts using
PILandreportlabto assemble PDFs. It also uses the system-levelsipsutility for converting HEIC images to PNG. - [EXTERNAL_DOWNLOADS]: Instructions include the installation of various common libraries such as
easyocr,pytesseract,reportlab, andpillow. These are retrieved from standard registries but represent external dependencies required for the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes text extracted via OCR from user-provided documents. There is a risk that malicious instructions hidden within a document (e.g., a fake bank statement) could be interpreted by the AI during the translation or script generation phase.
- Ingestion points: OCR-extracted text from image files provided by the user (as described in
SKILL.md). - Boundary markers: None. The instructions do not provide delimiters or context isolation for the extracted text.
- Capability inventory: Subprocess execution for
sips, package installation viapip, and dynamic execution of agent-generated Python scripts. - Sanitization: None. The skill does not specify any validation or filtering of the text extracted from documents before it is processed by the agent.
Audit Metadata