Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PDF documents which could contain adversarial text intended to influence the agent's behavior.
- Ingestion points: PDF files are read and processed in scripts/profile.py, scripts/form.py, and via CLI recipes in references/recipes.md.
- Boundary markers: The SKILL.md instructions establish strict invariants and use schema-versioned JSON for data exchange, creating logical boundaries between tool output and agent reasoning.
- Capability inventory: The skill can write files, execute shell commands for PDF transformation, and perform OCR.
- Sanitization: Content is processed by standard utilities like pdftotext, but the resulting raw text is not explicitly sanitized against potential injection patterns before being presented to the agent context.
- [COMMAND_EXECUTION]: The skill executes various local PDF utilities to perform its tasks.
- Evidence: scripts/profile.py and scripts/form.py use subprocess.run to call pdfinfo, qpdf, pdftotext, and pdfimages.
- Mitigation: Commands are executed using argument lists rather than shell strings, and input paths are resolved and validated before execution.
- [DYNAMIC_EXECUTION]: The skill uses Python heredocs to perform specialized table extraction at runtime.
- Evidence: references/recipes.md contains a recipe that pipes a Python script utilizing the pdfplumber library into a sub-process.
- Context: The script logic is static and hardcoded within the skill's documentation to ensure predictable behavior during extraction tasks.
Audit Metadata