weasyprint-pdf-creation
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/build_examples.pyandscripts/qa_pdf.pyusesubprocess.runto orchestrate the PDF generation and validation process. These calls are implemented using argument lists rather than shell strings, which is a secure practice that prevents shell injection vulnerabilities. - [COMMAND_EXECUTION]: The
SKILL.mdinstructions include commands for installing native system dependencies usingsudo apt-get. This is a standard and necessary step for the WeasyPrint rendering engine on Linux platforms to support font and layout libraries like Pango and HarfBuzz. - [SAFE]: Template rendering in
scripts/render_pdf.pyutilizes the Jinja2 engine withautoescapeexplicitly enabled. This ensures that data injected into HTML templates is properly sanitized, preventing injection attacks within the rendered documents.
Audit Metadata