The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it extracts text and data from untrusted PDF documents and presents them to the agent without sanitization or boundary markers.\n
Ingestion points: Untrusted PDF content is read and processed in SKILL.md, forms.md, and scripts/extract_form_structure.py using libraries like pypdf and pdfplumber.\n
Boundary markers: No delimiters or instructions are used to distinguish extracted PDF content from agent instructions, which could allow an attacker to influence agent behavior through content embedded in a PDF.\n
Capability inventory: The skill possesses significant capabilities, including file system writes (via pypdf and reportlab) and shell command execution (via poppler-utils and qpdf).\n
Sanitization: There is no evidence of filtering or sanitizing the extracted text before it is displayed to the agent.\n- [COMMAND_EXECUTION]: The skill involves the execution of various local command-line tools and custom Python scripts.\n
Evidence: SKILL.md and forms.md provide instructions for using pdftotext, qpdf, pdftk, and ImageMagick (magick) commands.\n
Evidence: The skill includes several internal Python scripts in the scripts/ directory that are invoked by the agent to automate form-filling workflows.\n
Context: These operations are standard for PDF processing tasks and do not involve remote code downloads from unknown sources.

pdf