ai-pdf-builder

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFEPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PRIVILEGE_ESCALATION]: The skill's installation instructions include sudo tlmgr install and sudo apt-get install. These commands require administrative privileges to install system-wide LaTeX packages and fonts necessary for high-quality document generation.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the ai-pdf-builder package from the npm registry and references source code hosted on GitHub. The usage examples frequently employ npx to download and execute code at runtime.
  • [COMMAND_EXECUTION]: The skill provides instructions for executing multiple CLI commands using npx ai-pdf-builder to perform system checks, generate professional PDFs from markdown, and run AI-based document enhancements.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data (markdown files and user-provided prompts) to generate or enhance documents, which presents a surface for indirect instructions to reach the underlying model.
  • Ingestion points: Local markdown files (e.g., content.md, draft.md) and user-supplied prompts passed to the ai command.
  • Boundary markers: The documentation mentions "Content Sanitization" for AI-generated output but does not explicitly define markers for input file boundaries.
  • Capability inventory: File system writing (-o flag), execution of external binaries (Pandoc, LaTeX), and network interaction for AI content generation.
  • Sanitization: The skill claims to include "Automatic cleanup of AI-generated content" to mitigate common issues.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 06:59 PM