bx-pdf
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for installing the
bx-pdfmodule using system commands likeinstall-bx-moduleand the CommandBoxbox installutility. - [EXTERNAL_DOWNLOADS]: The skill documents the acquisition of the
bx-pdfmodule, which is an external dependency provided by the ortus-boxlang vendor for the BoxLang platform. - [DYNAMIC_EXECUTION]: The skill utilizes the
bx:documentcomponent andincludedirectives to dynamically render BoxLang templates and scripts into PDF format at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external content, which could serve as a vector for instructions that might influence the agent's behavior during document generation.
- Ingestion points: The
bx:documentsectioncomponent supports fetching external content via thesrcattribute (URLs) and thesrcfileattribute (local file paths). Content is also ingested throughincludestatements within document blocks. - Boundary markers: No specific delimiters or safety instructions are described to separate system instructions from the content being processed into the PDF.
- Capability inventory: The skill is capable of performing network requests to retrieve content from external URLs and writing binary data to the local filesystem using the
filenameattribute or thefileWritefunction. - Sanitization: The documentation notes that the PDF generation process does not render active HTML features like JavaScript or iframes, providing a baseline level of sanitization for ingested content.
Audit Metadata