The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes text extracted from external images and PDF files, which introduces a potential surface for indirect prompt injection attacks. Maliciously crafted documents could contain instructions that the agent might accidentally follow when processing the OCR results.
Ingestion points: The ocr_image, ocr_pdf, and ocr_batch functions in scripts/ocr_helper.py serve as entry points for untrusted data from the file system.
Boundary markers: While SKILL.md provides detailed instructions for the agent to separate raw OCR from corrected notes and to inventory recognition gaps, it lacks explicit prompt-level delimiters or security instructions to treat the extracted text as untrusted content.
Capability inventory: The skill allows the agent to read arbitrary images and PDFs, execute complex machine learning models (Surya/Torch), and return the resulting text to the agent's context. The scripts/ocr_helper.py script also has the ability to modify local environment variables (os.environ) to manage batch sizes during execution.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the recognized text before it is returned to the agent, leaving the interpretation of any embedded commands to the agent's internal safety filters.

ocr-super-surya