pandoc-docx
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a standard utility for document conversion using Pandoc. Analysis shows no evidence of prompt injection, data exfiltration, obfuscation, or unauthorized network activity.
- [COMMAND_EXECUTION]: The skill utilizes shell commands to perform document conversions. It includes a helper script
scripts/convert.shthat wraps the localpandocexecutable to manage input and output directories (import/andexport/). All operations are confined to the local filesystem and serve the stated purpose of document processing. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external documents, which represents an ingestion surface for untrusted data. However, the operations are limited to format conversion using a local utility.
- Ingestion points: Source files located in the
import/directory are processed bypandoc(referenced inSKILL.mdandscripts/convert.sh). - Boundary markers: Absent.
- Capability inventory: Subprocess execution of the
pandoccommand and thescripts/convert.shwrapper script. - Sanitization: None.
Audit Metadata