Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external PDF files containing untrusted text or formatting layouts, which poses an indirect prompt injection surface if malicious instructions are embedded within the documents being processed.
- Ingestion points: Untrusted content enters the agent's context through
pypdf.PdfReaderandpdfplumberoperations as described inSKILL.md,forms.md, and handled byscripts/extract_form_field_info.pyandscripts/fill_fillable_fields.py. - Boundary markers: Absent. The instructions do not define strict boundary markers or instructions to isolate the parsed text from the agent's main operational command stream.
- Capability inventory: The skill possesses extensive file write/read capabilities to generate updated PDFs, images, and JSON metadata, found in
scripts/fill_fillable_fields.py,scripts/fill_pdf_form_with_annotations.py,scripts/convert_pdf_to_images.py, andscripts/create_validation_image.py. - Sanitization: Absent. Extracted data fields are processed directly without validation against instruction injection patterns.
Audit Metadata