pandoc-docx

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill is a standard utility for document conversion using Pandoc. Analysis shows no evidence of prompt injection, data exfiltration, obfuscation, or unauthorized network activity.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands to perform document conversions. It includes a helper script scripts/convert.sh that wraps the local pandoc executable to manage input and output directories (import/ and export/). All operations are confined to the local filesystem and serve the stated purpose of document processing.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external documents, which represents an ingestion surface for untrusted data. However, the operations are limited to format conversion using a local utility.
  • Ingestion points: Source files located in the import/ directory are processed by pandoc (referenced in SKILL.md and scripts/convert.sh).
  • Boundary markers: Absent.
  • Capability inventory: Subprocess execution of the pandoc command and the scripts/convert.sh wrapper script.
  • Sanitization: None.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 04:10 PM