react-pdf

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill requires the agent to generate and execute TypeScript/JSX code using the tsx runner to render PDF documents. This script generation and execution process is the core mechanism of the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructions involve processing data into generated PDFs without providing specific sanitization rules or boundary markers. This represents a potential surface for indirect injection if the rendered content contains instructions that the agent might inadvertently follow.
  • [EXTERNAL_DOWNLOADS]: The skill fetches TrueType font assets from Google's official font registry (fonts.gstatic.com) to ensure professional typesetting. These resources are retrieved via curl using URLs provided in a local reference file.
  • [COMMAND_EXECUTION]: The skill utilizes standard system tools and package managers—including npm, npx, pip, and pdftoppm—to manage the development environment, install library dependencies, and provide document previews.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 10:56 AM
Security Audit — agent-trust-hub — react-pdf