docx
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes the 'uv' installer from Astral's official domain (astral.sh) to manage its Python environment. This is a standard procedure for tools using the Astral ecosystem.\n- [COMMAND_EXECUTION]: Cross-platform wrapper scripts (Bash and PowerShell) are used to synchronize dependencies and execute the Python processing script via 'uv run'.\n- [SAFE]: The file processing logic in
main.pyimplements safe zip extraction practices by using only the filename portion of archive entries, mitigating potential path traversal risks during image extraction.\n- [SAFE]: The skill processes untrusted document content, which constitutes an indirect prompt injection surface; however, this is a known risk inherent to the primary function of document processing for AI context.
Audit Metadata