pdf

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes untrusted PDF data through text extraction and OCR, creating a surface for indirect prompt injection where instructions embedded in documents could influence the agent's actions.
  • Ingestion points: External PDF files are read into the agent's context via pypdf, pdfplumber, pytesseract, and pdftotext (SKILL.md, forms.md).
  • Boundary markers: The instructions do not implement explicit delimiters or boundary markers to distinguish extracted text from system prompts.
  • Capability inventory: The skill allows the agent to execute shell commands (qpdf, pdftotext, pdftk) and perform file system operations (SKILL.md, scripts/fill_pdf_form_with_annotations.py).
  • Sanitization: Extracted document content is processed without validation or sanitization of embedded instructions.- [COMMAND_EXECUTION]: The skill integrates several command-line utilities for PDF manipulation.
  • Evidence: Use of pdftotext, qpdf, pdftk, and pdftoppm for operations such as text extraction, document merging, and page rotation (SKILL.md).
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 06:30 PM
Security Audit — agent-trust-hub — pdf