skills/cycleuser/skills/tianbiao/Gen Agent Trust Hub

tianbiao

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents the use of LibreOffice (soffice --headless) to convert legacy Office formats (.doc, .xls) to modern ones (.docx, .xlsx). This is a standard utility function for document processing and is executed within the scope of user-initiated workflows.
  • [EXTERNAL_DOWNLOADS]: The documentation references installation of well-known, standard industry libraries (e.g., python-docx, openpyxl, pdfplumber) and system tools (Tesseract, PaddleOCR) for document parsing and OCR. These dependencies are necessary for the skill's primary purpose and originate from trusted repositories.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources including PDF files, images, and OCR outputs to populate templates. While this creates a theoretical surface for indirect prompt injection, the skill mitigates this through automated text cleaning, structural verification, and strict guidelines for objective, factual writing as outlined in rules/writing-analysis.md and rules/anti-aigc.md.
  • [DATA_EXPOSURE]: The skill processes student data (names, IDs, grades) which is standard for academic form filling. It follows security best practices by never overwriting original templates, performing data integrity checks through formula reverse-engineering, and providing verification steps to ensure accuracy.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 06:13 AM