paperjsx
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of specific npm packages from the @paperjsx scope (e.g., @paperjsx/json-to-pptx, @paperjsx/json-to-docx) which provide the logic for converting JSON specifications into document formats.
- [COMMAND_EXECUTION]: The document generation workflow involves the agent programmatically writing a Node.js script and then executing it via the command line to produce the output files.
- [DATA_EXFILTRATION]: The JSON schemas defined in the skill allow for the inclusion of remote image and logo URLs. While this is a common feature for document generation, it involves fetching external assets from arbitrary domains at runtime.
- [PROMPT_INJECTION]: The skill processes untrusted user-supplied data into document fields, creating a surface for indirect prompt injection. 1. Ingestion points: references/json-schema.md defines multiple text and markdown fields; 2. Boundary markers: Absent; 3. Capability inventory: node script execution and fs file writing in SKILL.md; 4. Sanitization: Absent.
Audit Metadata