alterlab-pdf

Warn

Audited by Gen Agent Trust Hub on Apr 12, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/fill_fillable_fields.py implements a monkeypatch on the pypdf library's DictionaryObject.get_inherited method to change how field attributes are retrieved. This is a form of dynamic code modification at runtime.
  • [COMMAND_EXECUTION]: The skill provides instructions and examples for executing various command-line utilities such as qpdf, pdftotext, pdftk, and pdftoppm for processing PDFs.
  • [PROMPT_INJECTION]: The skill processes untrusted external PDF files, which presents a surface for indirect prompt injection.
  • Ingestion points: PDF content is read by multiple scripts, including scripts/extract_form_field_info.py, scripts/extract_form_structure.py, scripts/fill_fillable_fields.py, and scripts/fill_pdf_form_with_annotations.py.
  • Boundary markers: No specific delimiters or instructions are used to isolate untrusted PDF content from agent instructions.
  • Capability inventory: The skill can read from and write to the local filesystem.
  • Sanitization: No sanitization of extracted PDF text is performed to prevent malicious instructions from being processed by the agent.
  • [EXTERNAL_DOWNLOADS]: The skill references several standard PDF processing libraries from official registries, including Python packages like pypdf, pdfplumber, reportlab, pytesseract, pdf2image, pypdfium2, pandas, Pillow, and numpy, as well as Node.js libraries like pdf-lib and pdfjs-dist.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 12, 2026, 12:47 AM
Security Audit — agent-trust-hub — alterlab-pdf