Warn
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The
buildcommand inscripts/pdf_cli.pyexecutes a Python script (the 'builder') usingsubprocess.run. This script is scaffolded from a local template (assets/starter_pdf.py) and is designed to be modified by the agent at runtime to generate PDFs. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external PDF files through the
inspectcommand inscripts/pdf_cli.py. - Ingestion points: PDF content is parsed using
pdfplumberandpypdfvia theinspect_documentfunction inscripts/pdf_cli.py. - Boundary markers: No specific delimiters or "ignore" instructions are added to the extracted text or JSON output provided to the agent.
- Capability inventory: The skill can execute shell commands (
pdfinfo,pdftoppm), run generated Python scripts, and perform file system operations (read/write). - Sanitization: Extracted text and table data are not sanitized or escaped before being returned to the agent's context.
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto invoke system utilitiespdfinfoandpdftoppmfor metadata extraction and page rendering. It also employs a bash script (scripts/pdf.sh) to manage a Python virtual environment and install dependencies fromruntime/requirements.txtviapip.
Audit Metadata