document-converter

Pass

Audited by Gen Agent Trust Hub on Mar 29, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides templates for executing local command-line utilities including LibreOffice, Ghostscript, pdftk, Tesseract, and ImageMagick. These commands are used to perform document transformations (e.g., Office to PDF, OCR, PDF merging) and operate on local file paths provided by the user. The skill includes a discovery step to check for tool availability and provides standard installation instructions for common package managers (apt, brew, winget).
  • [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it processes external document formats (PDFs, Images via OCR, Office files). Malicious instructions embedded within these documents could potentially influence the agent if it subsequently processes the extracted text.
  • Ingestion points: Untrusted file content is read and processed by libreoffice, tesseract, and convert.
  • Boundary markers: No specific delimiters or safety warnings for the agent regarding the content of processed files are defined in the instructions.
  • Capability inventory: The skill allows for local shell execution of document processing binaries.
  • Sanitization: The skill relies on the agent's environment to handle sanitization of file paths and does not provide internal validation logic for document content.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 29, 2026, 01:18 AM