The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to perform document analysis and verification. Specifically, it executes pdffonts to inspect PDF metadata and invokes the LaTeX compiler (e.g., pdflatex, xelatex, or lualatex) to verify that the reconstructed source code compiles correctly.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted content from PDF files and uses it to generate and execute LaTeX code without explicit sanitization.
Ingestion points: Text and structure are extracted from local PDF files using the fitz (PyMuPDF) and pdfplumber libraries, as shown in SKILL.md and the extraction guides.
Boundary markers: The instructions do not define boundary markers or include directives to the agent to ignore potentially malicious instructions embedded within the PDF content.
Capability inventory: The skill possesses capabilities to write to the local file system and execute shell commands (pdflatex, pdffonts), which are sensitive when processing untrusted input.
Sanitization: There is no mention of sanitizing extracted text to escape LaTeX special characters or commands (such as \write18) before they are included in the generated .tex file for compilation, which could lead to unauthorized command execution.
[EXTERNAL_DOWNLOADS]: The skill references several standard, well-known Python packages and system utilities for PDF processing, including pymupdf, pdfplumber, pytesseract, pdf2image, tesseract-ocr, and poppler-utils. These dependencies are documented for their legitimate use in extracting data and images from PDF documents.

pdf2tex