Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
pdftoppmcommand line utility from the Poppler suite to render PDF pages into images for visual inspection. This is a standard practice for ensuring layout fidelity in document processing workflows. - [EXTERNAL_DOWNLOADS]: The instructions include steps to install reputable Python packages (
reportlab,pdfplumber,pypdf) and system utilities (poppler-utils). These are standard industry tools for PDF manipulation and are fetched from official package registries or distribution repositories. - [PRIVILEGE_ESCALATION]: The skill provides installation commands for Ubuntu/Debian using
sudo apt-get. This is documented for the purpose of installing the necessary system dependencypoppler-utilsrequired for the skill's primary functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes PDF files which are untrusted external data. While it contains capabilities to execute shell commands (
pdftoppm) and write to the file system, these are scoped to the intended document processing purpose. - Ingestion points: Reads PDF content for extraction and rendering (SKILL.md).
- Boundary markers: None explicitly defined for isolating content within the PDFs.
- Capability inventory: Executes
pdftoppmvia shell, writes artifacts totmp/pdfs/andoutput/pdf/. - Sanitization: Relies on standard library handling of PDF structures.
Audit Metadata