pdf-to-markdown

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill functions as a document processor that ingests untrusted PDF files and converts them into Markdown text. This content is then added to the agent's context, creating a surface for indirect prompt injection if the PDF contains malicious instructions.
  • Ingestion points: The script scripts/lib/converter.cjs reads file content from user-provided paths.
  • Boundary markers: The skill lacks explicit delimiters or 'ignore' instructions around the extracted text in the final output.
  • Capability inventory: The skill environment allows for reading from and writing to the local filesystem.
  • Sanitization: There is no filtering or validation of the extracted text to neutralize potential injection attempts.
  • [PROMPT_INJECTION]: The SKILL.md file contains prescriptive instructions designed to override agent behavior, such as 'Ignore Claude-specific mode-switch instructions' and 'Strict execution contract' rules that forbid reordering or skipping steps.
  • [COMMAND_EXECUTION]: The skill is designed to run local JavaScript tools (scripts/convert.cjs) via the Node.js runtime to perform document processing.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of external dependencies from the NPM registry, including @opendocsg/pdf2md, pdfjs-dist, and tesseract.js.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 03:29 PM
Security Audit — agent-trust-hub — pdf-to-markdown