waliduj-podpis-pdf-pl
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts to perform signature validation. It involves running a Python script (
waliduj_podpis.py) via the command line. The script uses standard libraries and thepyHankopackage to inspect PDF metadata and cryptographic structures without executing arbitrary system commands. - [DATA_EXFILTRATION]: The skill explicitly configures the signature validation context (
ValidationContext(allow_fetching=False)) to disable remote network requests for certificate revocation lists (CRL) or OCSP checks. This ensures that the document analysis remains local and no data is sent to external servers. - [REMOTE_CODE_EXECUTION]: The script relies on
pyHanko, a reputable third-party library for PDF signature processing. No patterns of downloading or executing remote code or scripts from untrusted sources were detected. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes untrusted PDF files. However, the tool is strictly read-only and outputs structured validation results (JSON or text) rather than executing instructions found within the document.
- Ingestion points: Reads local PDF files provided as command-line arguments in
waliduj_podpis.py. - Boundary markers: The output is structured and intended for forensic verification, reducing the risk of the agent misinterpreting PDF content as instructions.
- Capability inventory: Limited to file reading and standard output; no file-write or network operations.
- Sanitization: The script extracts specific cryptographic and metadata fields (e.g., common name, serial number) rather than raw document content.
Audit Metadata