doc-format-converter
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill ingests untrusted data from user-supplied files, creating a surface where embedded instructions could potentially influence agent behavior. (1) Ingestion points: Documents are processed by
scripts/convert.py. (2) Boundary markers: No specific delimiters are added to the extracted content. (3) Capability inventory: The skill has file-writing capabilities to output the converted results. (4) Sanitization: The script parses content into a structured block model and performs standard escaping during rendering. - Offline Conversion Logic: All document processing is performed locally using established libraries, and no network access or data exfiltration patterns were observed.
- Reputable Dependencies: The skill uses standard document-handling packages, which is appropriate for a tool authored by a trusted vendor.
Audit Metadata