The Agent Skills Directory

[Secure Process Execution]: The skill executes external utilities like pdftotext and liteparse using spawnSync with an argument array. This implementation avoids shell invocation, which is a standard security practice to prevent command injection vulnerabilities.
[Text Decoding and Sanitization]: Custom decoders are used for RTF and XML formats to strip markup and handle entities. The logic includes a linear scan for detecting large Base64 blocks, which is a proactive measure to prevent potential Regular Expression Denial of Service (ReDoS) issues when processing untrusted input.
[External Dependencies]: The skill incorporates the @llamaindex/liteparse library for parsing complex document formats. This is an established package provided by a well-known service organization.
[Indirect Prompt Injection Surface]: Because the skill converts external documents into text for AI consumption, it functions as a processing point for untrusted data. If the resulting text is used to guide subsequent AI actions, the content within the processed documents could potentially influence those actions. Standard sanitization is applied during extraction, but the skill represents a typical data ingestion surface.

doc-extract