pdf

Pass

Audited by Gen Agent Trust Hub on May 15, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its ingestion of untrusted PDF files.
  • Ingestion points: Untrusted data enters the agent context via text and metadata extraction using pypdf (scripts/extract_form_field_info.py), pdfplumber, and OCR via pytesseract (SKILL.md).
  • Boundary markers: The instructions and scripts do not implement delimiters or isolation instructions to separate extracted untrusted content from the agent's internal prompt context.
  • Capability inventory: The skill allows the agent to execute shell commands for PDF processing (qpdf, pdftotext), write to the local filesystem (scripts/fill_pdf_form_with_annotations.py), and perform OCR.
  • Sanitization: There is no evidence of sanitization, filtering, or validation of the extracted PDF content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
May 15, 2026, 12:37 PM
Security Audit — agent-trust-hub — pdf