pdf-to-markdown
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill functions as a document processor that ingests untrusted PDF files and converts them into Markdown text. This content is then added to the agent's context, creating a surface for indirect prompt injection if the PDF contains malicious instructions.
- Ingestion points: The script scripts/lib/converter.cjs reads file content from user-provided paths.
- Boundary markers: The skill lacks explicit delimiters or 'ignore' instructions around the extracted text in the final output.
- Capability inventory: The skill environment allows for reading from and writing to the local filesystem.
- Sanitization: There is no filtering or validation of the extracted text to neutralize potential injection attempts.
- [PROMPT_INJECTION]: The SKILL.md file contains prescriptive instructions designed to override agent behavior, such as 'Ignore Claude-specific mode-switch instructions' and 'Strict execution contract' rules that forbid reordering or skipping steps.
- [COMMAND_EXECUTION]: The skill is designed to run local JavaScript tools (scripts/convert.cjs) via the Node.js runtime to perform document processing.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of external dependencies from the NPM registry, including @opendocsg/pdf2md, pdfjs-dist, and tesseract.js.
Audit Metadata