ocr-document-processor
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (images, scans, and PDFs) and returns the extracted text to the agent context, creating a surface for indirect prompt injection attacks.
- Ingestion points: Data enters the system through the
sourceargument inOCRProcessor(scripts/ocr_processor.py) and thefilepathargument inBusinessCardScanner.scan(scripts/business_card_scanner.py) andReceiptScanner.scan(scripts/receipt_scanner.py). - Boundary markers: The scripts do not implement explicit boundary markers or instructions to the agent to ignore embedded commands within the extracted text.
- Capability inventory: The skill possesses the ability to read from and write to the local file system (using
pathlib,json,csv, andcv2modules). - Sanitization: Basic sanitization is performed in the
export_htmlmethod ofOCRProcessor, which escapes HTML special characters (<and>). Other export formats do not appear to perform content sanitization.
Audit Metadata