The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands such as ls -la <path> and ls <folder_path>/*.{pdf,png,jpg,jpeg,webp,gif,bmp,tiff} using paths provided by the user. If the agent does not properly quote or validate these paths before execution, it could lead to command injection or unauthorized filesystem exploration.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from images and PDFs via OCR, which introduces a surface for indirect prompt injection where malicious instructions embedded in a document could influence the agent's behavior.
Ingestion points: PDF and image files are read and processed in the single-file and batch workflows described in SKILL.md.
Boundary markers: The skill lacks explicit delimiters or specific instructions for the subagents to ignore any commands or behavioral prompts found within the source documents.
Capability inventory: The agent and its subagents have access to shell listing (ls), file reading (Read), and file writing (Write) tools as defined in the SKILL.md workflows.
Sanitization: No validation, escaping, or filtering of the OCR-extracted text is performed before it is passed to the subagent or written back to the filesystem as Markdown.

ocr