visa-doc-translate
Warn
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes shell commands directly using
sipsfor image processing and system package managers (pip,brew) for dependency installation. - [REMOTE_CODE_EXECUTION]: The skill implements a workflow where it dynamically generates a Python script containing data extracted from user-provided images via OCR and then executes that script to generate a PDF. This pattern of code generation from untrusted data can lead to arbitrary code execution if the extracted text contains malicious code fragments that are not properly escaped before interpolation.
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs several third-party libraries including
easyocr,reportlab,pillow, andpytesseractfrom public repositories. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. 1. Ingestion points: Untrusted data enters the agent context via OCR text extraction from user-uploaded document images (e.g., bank statements, passports) in
SKILL.md. 2. Boundary markers: The instructions do not specify any delimiters or warnings to ignore instructions embedded within the extracted text. 3. Capability inventory: The agent has the ability to execute shell commands (sips,pip,brew) and run dynamically generated Python code. 4. Sanitization: There is no evidence of sanitization or escaping of the extracted text before it is used in the translation or code generation steps.
Audit Metadata