extracting-keywords
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of the
xbergcommand-line tool for document extraction and embedding. All commands are specific to the vendor's provided binary and represent standard usage of the platform's features. - [CREDENTIALS_SAFE]: The skill correctly demonstrates best practices for sensitive data by using an environment variable (
$OPENAI_API_KEY) in CLI examples rather than hardcoding credentials. - [EXTERNAL_DOWNLOADS]: The skill mentions that local embedding models are downloaded if not cached via the
xberg cache warmcommand. These downloads are part of the core functionality of the vendor's local-first embedding feature. - [INDIRECT_PROMPT_INJECTION]: The skill handles document extraction from external files (e.g.,
paper.pdf,report.pdf) and text inputs. While this presents an ingestion surface for untrusted data, the processing is limited to statistical keyword extraction (YAKE/RAKE) and vector embeddings, which do not involve LLM instruction following at the extraction stage.
Audit Metadata