report-to-google-doc

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • Execution of Local Planning Scripts: The skill uses an agent-invoked Python helper (report_to_google_doc_plan.py) to manage the conversion process. This script performs the heavy lifting of parsing HTML and preparing the final document structure, which is a common pattern for complex data transformation tasks.
  • Integration of System Rendering Utilities: For processing vector graphics in reports, the rendering module may invoke system utilities like rsvg-convert via subprocess.run. This allows the skill to handle various graphic formats by leveraging established external tools when native libraries are not available.
  • Dynamic Library Probing: The code includes logic to dynamically check for the availability of optional libraries such as Pillow and Playwright using __import__ or similar mechanisms. This design allows the tool to adapt its rendering strategy based on the host environment's installed capabilities.
  • Handling of External Report Data: The workflow involves parsing user-provided HTML and decoding embedded base64 image data. While processing untrusted external content represents a common interaction surface for indirect instructions, the skill uses programmatic parsing and includes validation steps before any document upload occurs.
  • Cloud Storage Interaction: The conversion results are uploaded to Google Drive through a specific MCP tool call. This operation is the primary objective of the skill and follows standard practices for document delivery in an agentic environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 06:12 AM
Security Audit — agent-trust-hub — report-to-google-doc