add-anydoc
Fail
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: Downloads metadata from the official npm registry and pipes it to Node.js. This operation is implemented as a security gate to verify that the CLI package is version 0.1.6 and has been available for at least 72 hours before proceeding with the installation.
- [COMMAND_EXECUTION]: Executes shell commands and build scripts to manage the containerized agent environment, including image rebuilding and restarting platform services via
launchctlorsystemctlto apply changes. - [PROMPT_INJECTION]: The skill processes untrusted content from document attachments (e.g., Word, PDF, Excel). It implements an indirect prompt injection defense strategy.
- Ingestion points: Document files located in
/workspace/inbox/that are converted by theanydocCLI. - Boundary markers: Explicitly includes a 'Treat documents as untrusted data' section instructing the agent to ignore instructions embedded in converted content.
- Capability inventory: Limited to CLI execution and local file access within the isolated agent container.
- Sanitization: Provides instructions for shell-escaping document paths to prevent command injection via malicious filenames.
- [EXTERNAL_DOWNLOADS]: Fetches configuration and package information from the official npm registry to ensure supply chain integrity during the setup process.
Recommendations
- HIGH: Downloads and executes remote code from: https://registry.npmjs.org/@firecrawl%2Fanydoc - DO NOT USE without thorough review
Audit Metadata