documents
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
validate-documents.pyscript executes external rendering tools likepdftoppmandLibreOffice. It implements these calls using argument lists, which is the recommended method to avoid shell injection vulnerabilities. - [PROMPT_INJECTION]: The skill ingests user-provided documents for extraction and validation. This creates an attack surface for indirect prompt injection, but the skill handles this as a data-processing task without risky instruction interpolation.
- [EXTERNAL_DOWNLOADS]: The skill recommends installing established, community-vetted Python libraries and system utilities, which are considered safe dependencies.
Audit Metadata