The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external system commands using the subprocess module to perform document processing.
Evidence: The _pdf_text function in scripts/case_store.py calls subprocess.run(["pdftotext", str(path), "-"], ...) to extract text from PDF files found within the case directories.
Mitigations: The skill uses a list-based argument format for subprocess.run, which prevents shell injection, and targets a specific well-known utility.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes untrusted data from external legal documents (PDFs) and case configuration files (YAML).
Ingestion points: The cmd_extract function in scripts/case_store.py scans project directories for PDF files and extracts their text content. The load_case function reads and parses case.yaml files.
Boundary markers: The CLI output and the generated Markdown/HTML views do not utilize explicit security delimiters (e.g., XML-like tags or warning markers) to isolate extracted PDF text from the agent's instructions.
Capability inventory: The skill script scripts/case_store.py has capabilities to perform atomic file writes to the local file system and execute shell commands via subprocess.
Sanitization: The extraction logic uses regex patterns to pull specific data points (like case numbers and dates), which reduces the amount of raw untrusted text passed to the agent but does not eliminate the risk of the agent interpreting instructions embedded in the document text.

case-progress