The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it extracts and processes text from PDF files which may contain instructions that could influence the agent's behavior.
Ingestion points: PDF content is read using pypdf, pdfplumber, and pytesseract across various scripts and documented examples (e.g., scripts/extract_form_field_info.py, scripts/extract_form_structure.py).
Boundary markers: No explicit delimiters or safety instructions are provided to the agent to treat extracted PDF text as untrusted or to ignore embedded instructions.
Capability inventory: The agent has high-level permissions including Bash and file system write access (Write, Edit), which increases the risk if an injection occurs.
Sanitization: Extracted text is processed and presented to the agent without filtering or sanitization.
[REMOTE_CODE_EXECUTION]: The script scripts/fill_fillable_fields.py utilizes runtime monkeypatching to modify the DictionaryObject.get_inherited method of the pypdf library. While this is used for a legitimate fix to handle PDF field attribute inheritance correctly, it involves dynamic modification of executable code at runtime.

pdf