document-generation
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a configurable environment variable (
DOCUMENT_MCP_CMD) to define the MCP server's execution command. This allows for flexible deployment of the necessary document processing infrastructure within the agent's runtime environment. - [SAFE]: The skill implements specific defenses against CSV/Excel formula injection. It prevents content beginning with
=from being interpreted as a formula by the target application, which is a key security measure for document generation tasks. - [SAFE]: Strict data integrity rules are enforced, requiring every data point to have a clear source and timestamp. The skill explicitly forbids filling gaps with fabricated data or guesses, ensuring the reliability of generated audit logs and reports.
- [SAFE]: Indirect Prompt Injection Surface Analysis:
- Ingestion points: The skill accepts external data to populate document blocks via writing tools.
- Boundary markers: Data must follow a strict JSON schema including source attribution.
- Capability inventory: Limited to file-system writes for specific document types.
- Sanitization: Active sanitization is performed on spreadsheet inputs to prevent malicious formula execution.
Audit Metadata