skills/ortus-boxlang/skills/bx-pdf/Gen Agent Trust Hub

bx-pdf

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for installing the bx-pdf module using system commands like install-bx-module and the CommandBox box install utility.
  • [EXTERNAL_DOWNLOADS]: The skill documents the acquisition of the bx-pdf module, which is an external dependency provided by the ortus-boxlang vendor for the BoxLang platform.
  • [DYNAMIC_EXECUTION]: The skill utilizes the bx:document component and include directives to dynamically render BoxLang templates and scripts into PDF format at runtime.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external content, which could serve as a vector for instructions that might influence the agent's behavior during document generation.
  • Ingestion points: The bx:documentsection component supports fetching external content via the src attribute (URLs) and the srcfile attribute (local file paths). Content is also ingested through include statements within document blocks.
  • Boundary markers: No specific delimiters or safety instructions are described to separate system instructions from the content being processed into the PDF.
  • Capability inventory: The skill is capable of performing network requests to retrieve content from external URLs and writing binary data to the local filesystem using the filename attribute or the fileWrite function.
  • Sanitization: The documentation notes that the PDF generation process does not render active HTML features like JavaScript or iframes, providing a baseline level of sanitization for ingested content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 09:01 AM
Security Audit — agent-trust-hub — bx-pdf