integrate-file-viewer
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the user to install the
react-pdfpackage from the npm registry to support PDF rendering. - [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to perform package installation and file operations during the setup process. - [DYNAMIC_EXECUTION]: The skill configures the PDF.js worker at runtime using a relative URL pointing to the
pdfjs-distpackage, which is the standard method for integrating this dependency in modern build environments. - [INDIRECT_PROMPT_INJECTION]: The skill defines a component that processes external data from Cognite Data Fusion projects, including file content and diagram annotations.
- Ingestion points: Data is fetched from CDF APIs and external URLs via the
useFileResolveranduseDocumentAnnotationshooks. - Boundary markers: Not applicable; the skill renders file content as a viewer and does not interpret the content as agent instructions.
- Capability inventory: Runtime capabilities are limited to network requests for file data and UI rendering. There are no shell or system-level capabilities available to the component at runtime.
- Sanitization: The component uses React's default escaping for rendering text content and SVG annotations, mitigating risks associated with untrusted text content.
Audit Metadata