pdf-official
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes command-line utilities such as
qpdf,pdftotext,pdfimages, andmagick(ImageMagick) for specialized PDF manipulation and image conversion tasks. - [EXTERNAL_DOWNLOADS]: The skill references several well-known third-party libraries for Python (
pypdf,pdfplumber,reportlab,pytesseract,pdf2image,pandas,pypdfium2,Pillow,numpy) and JavaScript (pdf-lib,pdfjs-dist) for PDF and data processing. - [PROMPT_INJECTION]: The skill's primary function involves extracting text and data from untrusted external PDF files, which represents a surface for indirect prompt injection attacks where content inside a document could attempt to influence agent behavior.
- [SAFE]: The script
scripts/fill_fillable_fields.pyimplements a runtime monkeypatch of thepypdflibrary. This is used to adjust the library's internal handling of inherited field attributes for form filling and does not involve the execution of untrusted code or external input.
Audit Metadata