Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides multiple Python scripts and command-line examples (e.g., qpdf, pdftotext) and instructs the agent to execute them for PDF document processing and manipulation tasks.- [INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted PDF files and JSON data, creating an entry point for embedded instructions in the processed content.
- Ingestion points: Scripts such as
scripts/extract_form_field_info.pyandscripts/fill_pdf_form_with_annotations.pyread user-supplied PDF files and JSON metadata. - Boundary markers: No specific delimiters or instructions are used to distinguish between data and prompt commands during processing.
- Capability inventory: The skill allows for local file system read/write operations and execution of scripts via the shell.
- Sanitization: Content processing relies on the
pypdfandpdfplumberlibraries, which perform parsing without explicit instruction filtering.- [DYNAMIC_EXECUTION]: The scriptscripts/fill_fillable_fields.pyperforms a runtime monkeypatch of thepypdflibrary'sget_inheritedmethod to fix a data handling bug when processing selection lists.- [PROMPT_INJECTION]: Theforms.mdfile uses authoritative language such as "CRITICAL: You MUST complete these steps in order" to enforce specific behavior and override the agent's default task planning.
Audit Metadata