Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PDF documents, which is a potential vector for instructions embedded in data to influence agent behavior.
- Ingestion points: External PDF files are read in scripts/extract_form_field_info.py, scripts/extract_form_structure.py, and SKILL.md.
- Boundary markers: The instructions in SKILL.md and forms.md lack explicit delimiters or warnings for the agent to ignore instructions found within document text.
- Capability inventory: The agent has capabilities to write files via scripts/fill_fillable_fields.py and execute shell commands as described in SKILL.md.
- Sanitization: No text sanitization or filtering logic is implemented for extracted content.
- [DYNAMIC_EXECUTION]: The script scripts/fill_fillable_fields.py performs runtime monkeypatching of the pypdf library's DictionaryObject.get_inherited method to handle specific form field property behaviors. While functional, this represents dynamic modification of executable code.
Audit Metadata