pdf-bib-import
Warn
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill dynamically generates Python scripts (/tmp/extract_bib.py and /tmp/import_to_lark.py) by writing code templates to the local filesystem and then executing them using the python3 interpreter. This pattern of script generation and execution allows the agent to perform complex automation but introduces a layer of dynamic behavior that requires monitoring.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user-supplied PDF files, creating an attack surface where malicious instructions embedded in a document could potentially influence the agent's behavior during the review or data-filling phase.
- Ingestion points: Local PDF files processed by the pdftotext utility as described in SKILL.md.
- Boundary markers: Absent; the extracted text preview is stored directly in a JSON structure for review without specific delimiters or instructions to ignore embedded commands.
- Capability inventory: The agent can execute system commands, write to the filesystem, and send data to an external API (Lark/Feishu) using lark-cli.
- Sanitization: Absent; the skill extracts raw text from the first two pages of the PDF to provide a preview for metadata completion.
- [COMMAND_EXECUTION]: The skill invokes several external binaries, including pdftotext, pdfinfo, and lark-cli, through shell commands and Python's subprocess module to manipulate files and interact with web services.
Audit Metadata