integrate-file-viewer

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions direct the user to install the react-pdf package from the npm registry to support PDF rendering.
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform package installation and file operations during the setup process.
  • [DYNAMIC_EXECUTION]: The skill configures the PDF.js worker at runtime using a relative URL pointing to the pdfjs-dist package, which is the standard method for integrating this dependency in modern build environments.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a component that processes external data from Cognite Data Fusion projects, including file content and diagram annotations.
  • Ingestion points: Data is fetched from CDF APIs and external URLs via the useFileResolver and useDocumentAnnotations hooks.
  • Boundary markers: Not applicable; the skill renders file content as a viewer and does not interpret the content as agent instructions.
  • Capability inventory: Runtime capabilities are limited to network requests for file data and UI rendering. There are no shell or system-level capabilities available to the component at runtime.
  • Sanitization: The component uses React's default escaping for rendering text content and SVG annotations, mitigating risks associated with untrusted text content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 02:14 PM
Security Audit — agent-trust-hub — integrate-file-viewer