Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its ingestion of untrusted PDF files.
- Ingestion points: Untrusted data enters the agent context via text and metadata extraction using pypdf (scripts/extract_form_field_info.py), pdfplumber, and OCR via pytesseract (SKILL.md).
- Boundary markers: The instructions and scripts do not implement delimiters or isolation instructions to separate extracted untrusted content from the agent's internal prompt context.
- Capability inventory: The skill allows the agent to execute shell commands for PDF processing (qpdf, pdftotext), write to the local filesystem (scripts/fill_pdf_form_with_annotations.py), and perform OCR.
- Sanitization: There is no evidence of sanitization, filtering, or validation of the extracted PDF content before it is processed by the agent.
Audit Metadata