pdf-reader
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PDF documents to extract text, tables, and structural data, creating a surface for indirect prompt injection.
- Ingestion points: Data is ingested through multiple scripts, including
scripts/extract-text.mjs,scripts/extract-tables.mjs, andscripts/search-text.mjs, which parse and return document content. - Boundary markers: While
scripts/extract-text.mjsuses--- Page N ---markers to separate content, there are no explicit instructions or protective delimiters to prevent the agent from following instructions embedded within the PDF text. - Capability inventory: The skill possesses file-system read (
fs.readFileSync) and write (fs.writeFileSync) capabilities. It does not have network access or arbitrary command execution functions. - Sanitization: The extracted text is provided to the agent without sanitization or filtering for potential prompt injection strings or control tokens.
Audit Metadata