docuseal-code
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation guides users to download and install official DocuSeal SDKs from public registries such as npm (@docuseal/api, @docuseal/react, etc.) and PyPI (docuseal). It also references the loading of frontend components from the official CDN (cdn.docuseal.com). These are standard integration steps for a well-known service.
- [COMMAND_EXECUTION]: Code examples in the reference files demonstrate how to use common developer tools like curl and the docuseal CLI to interact with the service's API. This usage is transparent and aligns with the skill's stated purpose as a coding reference.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of documents from user-supplied HTML, DOCX, and PDF files which contain dynamic variables and tags. This represents an inherent surface for indirect prompt injection if the source content is untrusted. However, the skill mitigates this risk by providing clear security recommendations, such as using read-only field attributes and verifying webhook payloads with HMAC signatures to ensure data integrity.
Audit Metadata