The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill communicates with external APIs for OCR services.
Endpoints include paddleocr.aistudio-app.com (PaddleOCR) and mineru.net (MinerU).
It also downloads processed images and result ZIP files from these services at runtime.
[DATA_EXFILTRATION]: By design, the skill uploads the content of PDF documents to external servers for processing.
scripts/pdf_ocr_paddle_api.py and scripts/pdf_ocr_mineru.py handle file transmission to cloud OCR providers.
The documentation in SKILL.md and references/ocr-backend-guide.md explicitly flags this behavior and provides a --local-only mode to keep data local, which follows privacy best practices for this use case.
[COMMAND_EXECUTION]: Several scripts execute external binaries to perform system tasks.
scripts/pdf-ocr.py calls the ocrmypdf and tesseract commands via subprocess.
scripts/pdf_runtime.py uses curl to perform file uploads when standard Python libraries fail.
scripts/pdf-preprocess-ocr.py uses the macOS-specific SetFile command to preserve file timestamps.
While commands are executed using argument lists (minimizing shell injection risk), they still represent powerful capabilities triggered by the agent.
[DYNAMIC_EXECUTION]: The skill uses importlib to dynamically load and execute local scripts within the scripts/ directory.
This pattern is used in scripts/pdf-ocr.py and scripts/pdf-preprocess-ocr.py to modularize functionality for OCR and compression stages.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PDF data and extracts text, which is subsequently provided to the agent, creating a risk surface for indirect prompt injection.
Ingestion points: Untrusted data enters the context through PDF text extraction in scripts/pdf_ocr_corrections.py (via generate_readable_text) and scripts/pdf-ocr-quality-check.py.
Boundary markers: Extracted text is returned without clear delimiters or instructions to ignore embedded commands.
Capability inventory: The skill possesses extensive capabilities including network operations, file system writes, and shell command execution across multiple scripts.
Sanitization: Content is normalized for spacing and formatting, but no filtering for potential malicious instructions is performed.

pdf-processor