pdfcraft-fill-pdf-forms
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill contains references and metadata pointing to external resources for documentation, tool binaries, and workflow adaptations.
- Fetches documentation and workflow guidelines from trusted sources including the official Anthropics skills repository and the well-known
pypdflibrary repository. - Contains metadata for the
pdfcrafttool runtime, including a download URL from GitHub (https://github.com/storytold/pdfcraft/releases/download/v0.8.0/pdfcraft-0.8.0-windows-x64-portable.zip) and a SHA256 checksum for integrity verification. - Suggests the installation of a sibling skill from the same vendor using
npx skills add full-aigc-skills/pdfcraft-skills --skill pdfcraft-editor. - [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a provided Python script to process form data.
- Evidence:
python3 <本技能目录>/scripts/form_request.py --fields fields.json --values values.json --doc 7 --output request.json - The script (
scripts/form_request.py) is a local utility that performs data validation and transformation. It does not perform network operations, use dynamic execution (likeeval), or spawn subprocesses. It uses safe file opening modes ('x'for exclusive creation) to prevent overwriting existing files. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from PDF form fields and user inputs, creating an indirect injection surface.
- Ingestion points: Reads
fields.json(raw form field data) andvalues.json(user-provided values) via theform_request.pyscript. - Boundary markers: The skill uses structured JSON for data exchange and relies on a validation script to enforce boundaries.
- Capability inventory: Uses MCP tools for PDF manipulation (
form_fields,form_fill,doc_save,page_render). - Sanitization: The
form_request.pyscript implements robust sanitization, including verifying field types, checking for read-only flags, rejecting NUL characters, and enforcing multiline constraints before generating any tool requests.
Audit Metadata