The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PDF data from external sources and extracts text/metadata which is then fed into the agent's context. This creates a surface for indirect prompt injection where instructions embedded in a PDF could trick the agent.
Ingestion points: Multiple scripts and instructions (SKILL.md, FORMS.md, scripts/extract_form_structure.py) ingest PDF content via pypdf, pdfplumber, and pytesseract.
Boundary markers: The instructions do not define boundary markers or clear 'ignore instructions' delimiters for the extracted text.
Capability inventory: The skill has broad capabilities including file system write access, execution of CLI tools (ImageMagick, qpdf, poppler-utils), and data manipulation.
Sanitization: There is no evidence of sanitization or filtering of the text extracted from PDFs before the agent uses it.
[DYNAMIC_EXECUTION]: The skill uses runtime code modification to alter the behavior of an external library.
Evidence: In scripts/fill_fillable_fields.py, the function monkeypatch_pydpf_method reassigns DictionaryObject.get_inherited from the pypdf library to a local wrapper function. This dynamic patching changes the execution logic of the dependency at runtime.

pdf