react-pdf
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill requires the agent to generate and execute TypeScript/JSX code using the
tsxrunner to render PDF documents. This script generation and execution process is the core mechanism of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill instructions involve processing data into generated PDFs without providing specific sanitization rules or boundary markers. This represents a potential surface for indirect injection if the rendered content contains instructions that the agent might inadvertently follow.
- [EXTERNAL_DOWNLOADS]: The skill fetches TrueType font assets from Google's official font registry (
fonts.gstatic.com) to ensure professional typesetting. These resources are retrieved viacurlusing URLs provided in a local reference file. - [COMMAND_EXECUTION]: The skill utilizes standard system tools and package managers—including
npm,npx,pip, andpdftoppm—to manage the development environment, install library dependencies, and provide document previews.
Audit Metadata