proportional-pdf-trimmer
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of PDF files provided by the user to perform whitespace trimming.
- Ingestion points: The
scripts/proportional_trim.pyscript reads the input PDF file specified by the user in theinput_pdfargument. - Boundary markers: The script operates on visual renders (pixmaps) of the PDF pages rather than parsing or interpreting text for instructions, which naturally isolates the logic from content-based injections.
- Capability inventory: The script's capabilities are limited to reading the input PDF, writing the transformed PDF to a specified path, and optionally writing a JSON report. It does not perform network operations, execute arbitrary shell commands, or use dynamic execution functions like
eval(). - Sanitization: The script treats the PDF content as image data for bounding box detection, preventing the interpretation of document text as code or instructions.
- [EXTERNAL_DOWNLOADS]: The skill's Python script requires two external libraries to be installed in the environment.
- Evidence:
import fitz(PyMuPDF) andimport numpy as npare used for PDF manipulation and image processing. - Context: These are well-known, industry-standard libraries used for their intended purposes in this script. They are typically installed via official package registries like PyPI.
Audit Metadata