docx
Pass
Audited by Gen Agent Trust Hub on Mar 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard system utilities including
pandocfor text extraction,unzip/zipfor document manipulation, andsoffice(LibreOffice) for PDF conversion. These are established tools for document processing workflows. - [EXTERNAL_DOWNLOADS]: The skill references the
docxlibrary for Node.js, which is a well-known and reputable package for programmatic document creation. - [PROMPT_INJECTION]: The skill processes untrusted external .docx files, creating an ingestion surface for potentially malicious instructions. 1. Ingestion points: External document files processed via
pandoc,unzip, andsofficeinSKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Execution of system commands (pandoc,unzip,zip,soffice,pdftoppm) and file system writes (fs.writeFileSync) throughoutSKILL.md. 4. Sanitization: No explicit sanitization or instruction-filtering is mentioned for the extracted text. - [SAFE]: No signs of data exfiltration, obfuscation, or malicious intent were detected. The skill is provided by a trusted source and its operations are necessary for document management.
Audit Metadata