xberg-chunking
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a documentation hub for a document processing SDK, providing usage guides, configuration schemas, and API references.
- [INDIRECT_PROMPT_INJECTION]: The tool is designed to process untrusted external documents (e.g., PDF, Word, HTML), which presents an inherent surface for indirect prompt injection. However, the documentation explicitly covers 'Security Limits' to prevent resource exhaustion and describes structured output formats that help maintain data boundaries.
- [EXTERNAL_DOWNLOADS]: The skill references downloading ML models from HuggingFace (e.g., Xenova/gpt-4o, BAAI/bge-small-en-v1.5) and installing packages via official registries (NPM, PyPI). These are standard practices for an ML-integrated library, and all vendor packages (@xberg-io) are consistent with the skill's author.
- [DYNAMIC_EXECUTION]: The library features a plugin system for registering custom post-processors and validators. This is a legitimate extensibility feature for developer tools and is presented with appropriate security configurations like resource caps.
Audit Metadata