draw
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
sofficecommand-line tool to automate drawing and conversion tasks. - Evidence: Shell commands for headless conversion (
soffice --headless --convert-to) and drawing (soffice --draw) inSKILL.md. - [PROMPT_INJECTION]: The skill processes untrusted external vector graphics and document files (SVG, PDF, ODG) which could contain malicious instructions designed to influence the agent.
- Ingestion points: External files ingested via conversion commands and Python UNO scripts in
SKILL.md. - Boundary markers: The instructions lack explicit boundary markers or warnings to disregard content embedded within processed files.
- Capability inventory: The skill utilizes shell execution capabilities (
soffice) and file system access to read and write document data (SKILL.md). - Sanitization: No sanitization or content validation steps are documented for the files being processed.
Audit Metadata