report-to-google-doc
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Local Command Execution: The skill utilizes
subprocess.runto call thersvg-convertutility for processing SVG graphics. This execution is performed using a list of arguments without a shell, which is a standard way to invoke local helper tools when available. - Data Processing Surface: As the skill ingests HTML reports from potentially untrusted sources, there is a surface for indirect prompt injection. The skill implements mitigation strategies by using a structural parser (BeautifulSoup) to extract specific report elements and generating intermediate manifests for validation before final document creation.
- Dynamic Dependency Resolution: A dynamic module check is used to detect the availability of the
Pillowlibrary. This allows the skill to choose the best available rendering path based on the local environment's installed packages.
Audit Metadata