The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted HTML and Markdown content without sanitization. A malicious input file could contain instructions or tags that exploit the PDF engine.
Ingestion points: The script scripts/generate_pdf.py reads content from files provided via the --input argument.
Boundary markers: No boundary markers or delimiters are used to isolate untrusted content from the processing logic.
Capability inventory: The tool can read local files, write to the filesystem, and perform network requests through the weasyprint library's resource fetching.
Sanitization: Content is passed directly to the markdown and weasyprint libraries without filtering or sanitizing dangerous HTML tags (e.g., <iframe>, <link>, or <img>).
[DATA_EXFILTRATION]: The PDF generation process can be exploited to expose sensitive data. By providing a malicious input file containing tags like <link rel="stylesheet" href="file:///etc/passwd">, an attacker could embed the contents of local system files into the generated PDF document.
[METADATA_POISONING]: The SKILL.md file contains a source repository link (https://github.com/foliojs/pdfkit) that corresponds to a JavaScript library, which is inconsistent with the Python implementation provided in scripts/generate_pdf.py. This discrepancy can mislead users regarding the software's provenance and security characteristics.

pdf-generator