The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it extracts and processes text from external PDF files using tools like pypdf, pdfplumber, and pytesseract (OCR).
Ingestion points: Data enters the system via text extraction in SKILL.md and image conversion/OCR described in forms.md.
Boundary markers: There are no explicit instructions or delimiters used to isolate extracted text from the agent's operational instructions.
Capability inventory: The skill possesses file system write access (PdfWriter.write) and command-line execution capabilities for tools like qpdf and pdftk.
Sanitization: No sanitization or validation of the extracted content is performed before it is processed by the agent.
[COMMAND_EXECUTION]: The documentation explicitly encourages the use of system command-line tools (pdftotext, qpdf, pdftk). While functional, this creates a surface for command injection if filenames or arguments derived from untrusted PDF metadata are not properly escaped.
[SAFE]: The script scripts/fill_fillable_fields.py performs runtime monkeypatching on the pypdf library (DictionaryObject.get_inherited) to work around a specific bug in form field handling. This is a localized, functional modification and does not represent a malicious dynamic execution vector.

pdf