upstage-document-parse
Pass
Audited by Gen Agent Trust Hub on Feb 22, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- DATA_EXFILTRATION (LOW): The skill transmits document content to api.upstage.ai, which is not on the whitelist of approved domains. This is the primary purpose of the skill.
- EXTERNAL_DOWNLOADS (LOW): Documentation references external Python libraries including langchain-upstage and requests.
- PROMPT_INJECTION (LOW): Vulnerable to indirect prompt injection as the agent processes parsed content from untrusted documents. 1. Ingestion points: User-provided document files parsed via API. 2. Boundary markers: Absent in instructions. 3. Capability inventory: Uses curl and requests for network communication. 4. Sanitization: No sanitization of parsed content is mentioned.
Audit Metadata