Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided PDF files, which presents a surface for indirect prompt injection via extracted text or metadata. 1. Ingestion points: PDF documents read by pypdf and pdfplumber in SKILL.md and extract_form_field_info.py. 2. Boundary markers: No delimiters are used for extracted content. 3. Capability inventory: File system writes and subprocess execution of CLI tools in SKILL.md and fill_fillable_fields.py. 4. Sanitization: Extracted text is not sanitized before processing.
- [DYNAMIC_EXECUTION]: The script scripts/fill_fillable_fields.py uses runtime monkeypatching to modify the pypdf library's internal logic for handling form field inheritance, which is a benign functional adjustment.
- [EXTERNAL_DOWNLOADS]: The documentation encourages the installation of well-known PDF processing libraries and utilities, including pypdf, pdfplumber, reportlab, and qpdf, which are standard tools for this domain.
- [COMMAND_EXECUTION]: The instructions guide the agent to perform various PDF operations using standard command-line tools like qpdf, pdftotext, and pdftk.
Audit Metadata