Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to extract text and data from PDF files, creating a surface for indirect prompt injection attacks where malicious instructions in a document could influence agent behavior.
- Ingestion points: Text is extracted in SKILL.md using pypdf.PdfReader.extract_text(), pdfplumber.extract_text(), and OCR via pytesseract.image_to_string().
- Boundary markers: No delimiters or specific instructions are provided to the agent to treat extracted text as untrusted data.
- Capability inventory: The skill includes file system write access (writing PDFs, Excel files) and execution of CLI tools (qpdf, pdftotext, pdftk).
- Sanitization: No sanitization or filtering of the extracted content is implemented in the provided examples.
Audit Metadata