Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides and instructs the agent to use several Python scripts (e.g.,
extract_form_field_info.py,fill_fillable_fields.py,convert_pdf_to_images.py) and command-line tools likeqpdf,pdftotext, andpdftkto perform document processing and form-filling tasks. - [EXTERNAL_DOWNLOADS]: The documentation recommends the installation of reputable, standard PDF processing libraries including
pypdf,pdfplumber,reportlab,pytesseract,pdf2image,pypdfium2,pdf-lib, andpdfjs-distvia package managers like pip and npm. - [SAFE]: The skill processes untrusted PDF files and associated JSON metadata. While this represents a data ingestion surface, the processing logic is limited to standard document manipulation and includes structural validation steps (like checking for overlapping bounding boxes) without any signs of malicious exploitation.
- [SAFE]: A localized monkeypatch is implemented in
scripts/fill_fillable_fields.pyfor thepypdflibrary to resolve a specific inherited bug related to selection list fields, which is a standard development practice for handling upstream library limitations.
Audit Metadata