audit-report-generator
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: No malicious code, obfuscation, or unauthorized network activity was detected. The skill functions as a local document transformation utility using established tools. Behavior is consistent with the described intent of converting markdown findings into PDF format.
- [COMMAND_EXECUTION]: The skill includes a bash script (
scripts/make-pdf.sh) that executespandoc,perl, and standard file utilities (cp,mv,rm). These operations are used to process markdown input and generate PDF output locally. Command parameters are properly quoted to mitigate shell injection risks. - [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection because it processes markdown files containing raw LaTeX commands through Pandoc. Ingestion point:
scripts/make-pdf.shreads user-provided input files. Boundary markers: None. Capability inventory:pandocwith LaTeX compilation,perlfor text substitution. Sanitization: None. This is a low-risk surface inherent to the tool's purpose and does not indicate malicious intent.
Audit Metadata