pdf

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous examples and scripts that execute command-line tools such as qpdf, pdftotext, pdftk, and magick. These are standard utilities for PDF and image processing and are used here within their intended functional scope.
  • [REMOTE_CODE_EXECUTION]: The skill mentions external dependencies and libraries (e.g., pypdf, pdfplumber, reportlab, pytesseract, pdf2image, pdf-lib). All referenced packages are well-known, industry-standard tools for PDF manipulation. There are no patterns of piping remote URLs directly to a shell or executing unverifiable code.
  • [DATA_EXPOSURE]: The skill includes functionality for handling PDF passwords via qpdf and pypdf. The examples use local variables or placeholders and do not demonstrate exfiltration of these credentials.
  • [DYNAMIC_EXECUTION]: Several scripts involve dynamic PDF generation (e.g., reportlab canvas drawing and pypdf annotation injection). These use standard API calls for document creation and do not involve eval(), exec(), or unsafe deserialization of untrusted input.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 03:04 PM
Security Audit — agent-trust-hub — pdf