ocr-and-documents
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill parses and outputs content from untrusted external documents (PDF, DOCX, PPTX), creating a potential vector for indirect prompt injection where malicious instructions embedded in a document could influence the agent's behavior.
- Ingestion points: Files are read and processed in
scripts/extract_marker.pyandscripts/extract_pymupdf.py. - Boundary markers: The script
scripts/extract_pymupdf.pyincludes basic page delimiters (--- Page X/Y ---) which offer limited separation between document content and system instructions. - Capability inventory: The skill can write files (images) to the local disk and returns large volumes of extracted text to the agent context.
- Sanitization: The extracted text is not sanitized or filtered for potential instructional content before being processed by the agent.
- [EXTERNAL_DOWNLOADS]: The
marker-pdfdependency fetches approximately 2.5GB of model weights from Hugging Face during its initial setup. This is a documented behavior of the underlying library for performing high-quality OCR.
Audit Metadata