Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PDF files that may contain instructions designed to influence the agent's behavior.\n
- Ingestion points: The skill uses
pypdf.PdfReaderandpdfplumber.openacross various scripts (e.g.,scripts/extract_form_structure.py,scripts/extract_form_field_info.py) to ingest data from external PDF files.\n - Boundary markers: There are no delimiters or warnings defined to distinguish between data and potential instructions within the PDF content.\n
- Capability inventory: The skill allows for local file writes (PDF, Excel, images) and grants the agent terminal access to execute PDF processing scripts and CLI tools.\n
- Sanitization: The skill lacks sanitization or filtering of the extracted content before it is used by the agent.\n- [DYNAMIC_EXECUTION]: The script
scripts/fill_fillable_fields.pyperforms a runtime monkeypatch of thepypdflibrary to modify its internal behavior.\n - Evidence: The function
monkeypatch_pydpf_methodredefinesDictionaryObject.get_inheritedat runtime to change how field attributes are retrieved.
Audit Metadata