ocrmypdf
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides documentation and usage examples for a legitimate and widely-used open-source OCR utility. No prompt injection, obfuscation, or data exfiltration attempts were found.\n- [EXTERNAL_DOWNLOADS]: The skill references standard installation procedures using trusted system package managers (apt, dnf, brew, pkg, snap) and the official Python package registry (pip). All external links point to official documentation on GitHub and ReadTheDocs.\n- [COMMAND_EXECUTION]: The skill provides examples of command-line interface usage for the
ocrmypdftool to process local files, which is consistent with the skill's stated purpose.\n- [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow for processing external PDF and image files (input.pdf,scan.png). Evidence chain: 1. Ingestion points: File paths provided to the CLI tool. 2. Boundary markers: None present. 3. Capability inventory: File system read/write and CLI tool execution. 4. Sanitization: Relies on the security of the underlyingocrmypdf, Tesseract, and Ghostscript libraries. While this represents an attack surface for maliciously crafted documents, it is an inherent part of the tool's functionality.
Audit Metadata