doc-reader

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses web_fetcher.py and scripts/instructions.md to download content from external URLs and PDF files for translation purposes. It also downloads images referenced in documents to provide a complete local preview. These operations are core to the skill's stated purpose.
  • [COMMAND_EXECUTION]: The skill executes shell commands via subprocess.run() in scripts/generate_slides.py to invoke the codex CLI. This is used for generating AI slides based on document metadata. It also uses cp and chmod to manage script execution within the output directory. These commands are localized to the user's workspace and intended for processing the documents.
  • [DYNAMIC_EXECUTION]: The scripts/build.py script dynamically generates a preview.html file by embedding Markdown content and Base64-encoded images. The resulting HTML includes a remote dependency (https://cdn.jsdelivr.net/npm/marked/marked.min.js) for rendering Markdown in the browser, which is a common and legitimate practice for static site generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 03:13 AM
Security Audit — agent-trust-hub — doc-reader