Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted PDF data through text extraction and OCR, creating a surface for indirect prompt injection where instructions embedded in documents could influence the agent's actions.
- Ingestion points: External PDF files are read into the agent's context via
pypdf,pdfplumber,pytesseract, andpdftotext(SKILL.md, forms.md). - Boundary markers: The instructions do not implement explicit delimiters or boundary markers to distinguish extracted text from system prompts.
- Capability inventory: The skill allows the agent to execute shell commands (
qpdf,pdftotext,pdftk) and perform file system operations (SKILL.md, scripts/fill_pdf_form_with_annotations.py). - Sanitization: Extracted document content is processed without validation or sanitization of embedded instructions.- [COMMAND_EXECUTION]: The skill integrates several command-line utilities for PDF manipulation.
- Evidence: Use of
pdftotext,qpdf,pdftk, andpdftoppmfor operations such as text extraction, document merging, and page rotation (SKILL.md).
Audit Metadata