doc-ocr
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (PDFs and images) and converts them into text that is returned to the agent's context. This presents a surface for indirect prompt injection if a document contains instructions designed to manipulate the AI's behavior.
- Ingestion points: Reads files provided by the user via
fitz.open(path)for PDFs and macOS Vision API for images inscripts/dococr.py. - Boundary markers: The output is prefixed with a filename header (
# filename), but there are no explicit delimiters or instructions to the agent to ignore potentially malicious text within the OCR results. - Capability inventory: The script has file read/write capabilities (writing OCR results to disk) and command execution capability as it is a CLI tool meant to be run by the agent.
- Sanitization: The script performs basic newline replacement for Markdown output but does not sanitize the extracted text for prompt injection patterns.
Audit Metadata