adobe-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation references official Adobe SDKs as required dependencies for implementing the provided examples.\n
- Evidence: The prerequisites section mentions the need for
@adobe/firefly-apisand@adobe/pdfservices-node-sdk.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for processing external data such as PDF files and remote images, which constitutes a potential surface for indirect prompt injection if the resulting output is processed by an AI agent.\n - Ingestion points: Code in
SKILL.mdreads local files (e.g.,sample.pdf) and fetches data from remote URLs.\n - Boundary markers: The minimal examples do not include explicit delimiters or instructions to the agent to ignore potentially embedded commands in the source data.\n
- Capability inventory: The examples utilize file system read/write capabilities (
fs.createReadStream,fs.createWriteStream) and network operations (fetch) inSKILL.md.\n - Sanitization: No explicit sanitization or validation of the ingested content is present in the boilerplate code.\n- [DATA_EXFILTRATION]: The code examples demonstrate necessary network operations to transmit data to official Adobe API endpoints for design and document processing.\n
- Evidence: HTTP POST requests are made to
firefly-api.adobe.ioandimage.adobe.ioinSKILL.mdto perform image generation and background removal.
Audit Metadata