The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads official PaddlePaddle packages and OCR models. These are sourced from well-known domains (paddlepaddle.org.cn) and standard package registries (PyPI), representing legitimate dependencies for the skill's functionality.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection through its ingestion of external data.
Ingestion points: batch_ocr.py extracts text from user-provided images and PDF files via OCR.
Boundary markers: The SKILL.md file defines a "Refinement Protocol" (润色协议) that provides instructions to the LLM on how to process the text, including constraints like "保真" (Fidelity) and "不要凭空补写" (Do not hallucinate content not present in the original).
Capability inventory: The skill uses an LLM to refine text and generates Markdown files (.md) as output. It includes file system write capabilities via scripts/batch_ocr.py and scripts/dump_raw.py to save the results.
Sanitization: No explicit sanitization or filtering is performed on the raw OCR text before it is interpolated into the LLM prompt for refinement, meaning malicious text in a handwritten note could potentially influence the LLM's behavior during the refinement step.

handwriting-ocr