Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PDF files to extract and fill form data, creating an attack surface where malicious content within a PDF could attempt to influence the agent's behavior. \n
- Ingestion points: Files such as scripts/extract_form_field_info.py and scripts/fill_fillable_fields.py ingest user-provided PDF documents. \n
- Boundary markers: The skill uses structured JSON formats (fields.json) and visual validation images as boundaries, but these do not fully prevent the processing of adversarial text embedded in the PDF. \n
- Capability inventory: The skill can read/write files and execute PDF manipulation commands via libraries like pypdf and pdfplumber. \n
- Sanitization: There is no evidence of text sanitization for content extracted from PDF documents before the agent uses it for form-filling logic. \n- [DYNAMIC_EXECUTION]: The script scripts/fill_fillable_fields.py performs a monkeypatch on the pypdf library at runtime. \n
- Evidence: The function monkeypatch_pydpf_method overrides DictionaryObject.get_inherited to resolve a known bug in pypdf version 5.7.0 related to selection list fields. While this is a common developer practice for bug workarounds, it involves modifying library behavior during execution.
Audit Metadata