The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to extract text, tables, and metadata from PDF files using libraries like pypdf, pdfplumber, and pdftotext. This extracted content is then processed by the agent, which presents a surface for indirect prompt injection if a PDF contains malicious instructions designed to manipulate the agent's behavior.
Ingestion points: PDF file processing in SKILL.md, forms.md, and scripts like extract_form_field_info.py and extract_form_structure.py.
Boundary markers: None detected; the skill does not wrap extracted text in delimiters or include warnings to ignore instructions within the PDF content.
Capability inventory: The skill utilizes file system operations (reading/writing PDFs and images) and shell command execution (qpdf, pdftotext, magick).
Sanitization: No sanitization or filtering of extracted text is performed before it is passed to the agent context.
[DYNAMIC_EXECUTION]: The script scripts/fill_fillable_fields.py performs runtime modification of the pypdf library via monkeypatching (DictionaryObject.get_inherited = patched_get_inherited). While used here for correcting field inheritance behavior, dynamic modification of library internals is a technique that can be misused to alter library logic at runtime.
[COMMAND_EXECUTION]: The skill instructions and scripts invoke external command-line tools including qpdf, pdftotext, pdftoppm, pdftk, and magick (ImageMagick) to perform PDF manipulations and image processing. This grants the agent the ability to execute system-level commands which could be abused if command arguments are improperly sanitized from untrusted PDF data.
[EXTERNAL_DOWNLOADS]: The skill requires several external Python and JavaScript dependencies for its functionality, including pypdf, pdfplumber, reportlab, pandas, pytesseract, pdf2image, pypdfium2, pdf-lib, and pdfjs-dist. These are well-known libraries in the PDF processing ecosystem.

pdf