Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from untrusted PDF files which may contain malicious instructions designed to influence the agent's behavior. 1. Ingestion points: PDF files are read using pypdf, pdfplumber, and pytesseract across multiple scripts and guides (SKILL.md, forms.md). 2. Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when processing extracted text. 3. Capability inventory: The skill utilizes command-line tools (qpdf, pdftotext) and performs file-write operations (creating PDFs, images, and data files). 4. Sanitization: Content is extracted and used directly without specific sanitization for prompt injection patterns.
- [EXTERNAL_DOWNLOADS]: The skill relies on and provides instructions for several external Python libraries (pypdf, pdfplumber, reportlab, pandas, pytesseract, pdf2image, pypdfium2, Pillow) and system utilities (qpdf, poppler-utils). These are standard, well-known tools for PDF manipulation from established sources.
- [DYNAMIC_EXECUTION]: The script scripts/fill_fillable_fields.py implements a monkeypatch for the pypdf library to fix specific behavior regarding inherited field attributes. This is a controlled modification of the execution environment for compatibility purposes and does not pose a security risk.
Audit Metadata