The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PDF files to extract text, metadata, and visual structure, creating a surface for malicious instructions to influence the agent.
Ingestion points: scripts/extract_form_field_info.py (reads PDF field names and values), scripts/extract_form_structure.py (extracts text labels and layout using pdfplumber), and scripts/convert_pdf_to_images.py (renders PDF pages to images for analysis).
Boundary markers: Absent. The instructions in forms.md do not provide delimiters or warnings to ignore instructions embedded within the PDF content.
Capability inventory: The skill can write files to the local file system (using pypdf's PdfWriter.write and PIL's Image.save) and suggests the execution of multiple command-line utilities.
Sanitization: Absent. The scripts do not perform validation or escaping of extracted content before presenting it to the agent.
[METADATA_POISONING]: The LICENSE.txt file contains copyright notices and terms attributed to "Anthropic, PBC", while the skill's YAML frontmatter identifies the author as "bitcjm". This contradictory metadata is misleading regarding the skill's provenance and may lead to an incorrect assessment of its safety.
[COMMAND_EXECUTION]: The documentation in SKILL.md and forms.md explicitly directs the agent to execute external command-line tools including pdftotext, qpdf, pdftk, and magick (ImageMagick).
[DYNAMIC_EXECUTION]: The script scripts/fill_fillable_fields.py performs a runtime monkeypatch of the pypdf library's DictionaryObject.get_inherited method. Furthermore, the build.sh script executes an external Python utility (strip_comments.py) using a path relative to the repository root, which is outside the immediate skill directory structure.

pdf