document-quality-check
Document Quality Check skill for Datasite deal rooms. Use this skill whenever a deal team wants to audit document quality before going live to buyers. Triggers include: "check document quality", "flag bad documents", "find password protected files", "check for blank documents", "PII check", "redaction review", "find corrupted files", "document audit", "quality check the data room", "are there any blank or broken files", "check for unredacted personal data", or any request to verify that documents in the data room are complete, accessible, and safe to share. Use this skill proactively before a data room goes live. Do not use for renaming files (use smart-file-renaming) or for identifying missing sections (use gap-analysis).
68
82%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
At runtime, the skill’s required Phase B uses `searchDocuments` (Check 3/4/11) to ingest document content snippets and text returned by the Datasite/Blueflame search tool into the agent’s LLM context, and that document content is outsider-authored (uploaded by other parties into the deal room), creating an indirect prompt-injection exposure path.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill's dashboard instructs embedding and loading a remote JavaScript library from https://cdnjs.cloudflare.com/ajax/libs/xlsx/0.18.5/xlsx.full.min.js (SheetJS) which will be fetched and execute code in the user's browser at runtime to provide the "Download as Excel" functionality, and the dashboard explicitly depends on it.
- Repository
- openai/plugins
- Commit
11c74d6
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.