Skills
Navigate
skills/gorenku/studio-skills/screenplay-pdf-to-fdx/Gen Agent Trust Hub

screenplay-pdf-to-fdx

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PDF files which could contain malicious instructions.
  • Ingestion points: The scripts/extract_pdf_layout.py script extracts text from user-provided screenplay PDFs.
  • Boundary markers: The workflow requires the agent to author a conversion manifest and perform visual reconciliation, ensuring the agent follows the manifest structure rather than raw PDF text.
  • Capability inventory: The skill can execute PDF processing tools via subprocess and write output files to the project workspace.
  • Sanitization: The scripts/build_fdx.py script uses xml.etree.ElementTree to build the final output, which automatically handles character escaping to prevent XML injection.
  • [COMMAND_EXECUTION]: The skill executes external command-line tools to process PDF files.
  • Evidence: scripts/extract_pdf_layout.py calls pdftotext and pdftoppm using subprocess.run.
  • Context: Command invocation is performed safely using argument lists instead of shell strings, and the script validates tool availability using shutil.which before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 04:06 PM