rtl-document-translation
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The core functionality of the skill relies on the
python-docxandPillowlibraries to manipulate document XML and generate visual representations. These are well-established, legitimate tools for document processing. - [COMMAND_EXECUTION]: The skill's documentation and reference code include patterns for using
subprocess.runto invoke external binaries likesoffice(LibreOffice) andpdftoppm(Poppler). These calls are used for document format conversion (DOCX to PDF) and visual verification (PDF to images) and are implemented using safe list-based argument structures to prevent shell injection. - [EXTERNAL_DOWNLOADS]: The skill lists
python-docxandPillowas required dependencies. These are standard packages available on the official Python Package Index (PyPI). - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting and processing content from external
.docxfiles. While these files represent an untrusted data surface, the skill's logic is restricted to text translation and formatting preservation, minimizing the risk of the agent executing instructions embedded within the documents.
Audit Metadata