report-to-google-doc
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Execution of Local Planning Scripts: The skill uses an agent-invoked Python helper (
report_to_google_doc_plan.py) to manage the conversion process. This script performs the heavy lifting of parsing HTML and preparing the final document structure, which is a common pattern for complex data transformation tasks. - Integration of System Rendering Utilities: For processing vector graphics in reports, the rendering module may invoke system utilities like
rsvg-convertviasubprocess.run. This allows the skill to handle various graphic formats by leveraging established external tools when native libraries are not available. - Dynamic Library Probing: The code includes logic to dynamically check for the availability of optional libraries such as Pillow and Playwright using
__import__or similar mechanisms. This design allows the tool to adapt its rendering strategy based on the host environment's installed capabilities. - Handling of External Report Data: The workflow involves parsing user-provided HTML and decoding embedded base64 image data. While processing untrusted external content represents a common interaction surface for indirect instructions, the skill uses programmatic parsing and includes validation steps before any document upload occurs.
- Cloud Storage Interaction: The conversion results are uploaded to Google Drive through a specific MCP tool call. This operation is the primary objective of the skill and follows standard practices for document delivery in an agentic environment.
Audit Metadata