pdf-official
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: All identified dependencies, including Python packages like pypdf and pdfplumber and Node.js libraries like pdf-lib, are well-known and reputable tools for document processing.
- [COMMAND_EXECUTION]: The skill instructions and scripts utilize standard system utilities such as qpdf, pdftotext, and pdftk to perform document transformations. These operations are restricted to the local filesystem and serve legitimate PDF manipulation purposes.
- [SAFE]: The runtime monkeypatch of the pypdf library in fill_fillable_fields.py is a documented workaround for a library-specific bug related to selection list fields and does not introduce security vulnerabilities or untrusted code execution paths.
- [PROMPT_INJECTION]: The skill processes untrusted PDF files, creating a potential surface for indirect prompt injection. This is mitigated by the structured workflow in forms.md which mandates automated validation and manual verification of output. Ingestion points: scripts/convert_pdf_to_images.py and scripts/extract_form_field_info.py. Boundary markers: Absent. Capability inventory: Subprocess execution of Python scripts and CLI utilities, file system writes. Sanitization: scripts/check_bounding_boxes.py provides geometric validation of extracted fields but does not sanitize PDF content.
Audit Metadata