nano-pdf
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the
uvtool to install thenano-pdfpackage from the official PyPI registry. This is a standard procedure for adding CLI capabilities to an agent skill.- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it processes PDF files based on natural language instructions. If an untrusted PDF contains malicious text intended to be interpreted as instructions, it could attempt to manipulate the editing process. - Ingestion points: PDF file content processed by the
nano-pdf editcommand inSKILL.md. - Boundary markers: None are defined to isolate the PDF content from the tool's instructions.
- Capability inventory: The skill has the capability to modify local PDF files.
- Sanitization: No content sanitization or validation is specified in the skill code.
Audit Metadata