doc-docx
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill refers to using the
libreofficecommand-line tool to perform PDF conversions of generated documents (libreoffice --headless --convert-to pdf output.docx). This is a standard and expected operation for a document generation workflow. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied content to populate document templates, presenting a surface for indirect prompt injection if the input contains malicious instructions. * Ingestion points: User input for document content as specified in
SKILL.md. * Boundary markers: Structured document layouts and templates provided inreferences/modern-templates.md. * Capability inventory: Usespython-docxfor document creation and shell execution for PDF conversion vialibreoffice. * Sanitization: Employs a QA checklist inreferences/qa-checklist.mdto identify unreplaced placeholders and filter 'AI slop' phrases.
Audit Metadata