pdftk-server
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a variety of command-line examples for the pdftk utility to perform PDF manipulations such as merging, splitting, rotating, and repairing files.
- [EXTERNAL_DOWNLOADS]: The skill includes instructions for installing the pdftk tool through official system package managers including winget, brew, apt, and dnf. It also provides a link to download the source code from the official vendor website for manual compilation.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external PDF files and form data (FDF/XFDF), which serves as an ingestion point for potentially untrusted data.
- Ingestion points: Input PDF files and data files (FDF/XFDF) are read and processed by the pdftk command as specified in the workflows.
- Boundary markers: The instructions do not specify explicit delimiters or warnings to ignore embedded instructions within processed PDFs.
- Capability inventory: The pdftk tool possesses capabilities to read, modify, and write PDF files, including metadata and attachments.
- Sanitization: There is no mention of specific sanitization or validation steps for the content of the PDF files being processed.
Audit Metadata