langchain-document-loaders
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing well-known, legitimate development packages including
@langchain/community,pdf-parse, andplaywrightvia official package registries. - [COMMAND_EXECUTION]: The skill documents the use of
PlaywrightWebBaseLoader, which includes a dynamic execution capability (evaluate) to process JavaScript on remote web pages. This is a standard and documented feature of the Playwright library for handling dynamic content. - [PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by teaching the agent how to ingest untrusted data from external sources (PDFs, URLs, and GitHub repositories) into its context. However, it does not include any instructions that attempt to bypass safety filters or override agent behavior.
- [DATA_EXFILTRATION]: The skill demonstrates how to load files and fetch data from the web. These operations are restricted to the intended purpose of document loading for RAG systems and include no evidence of unauthorized credential harvesting or data exfiltration.
Audit Metadata