The Agent Skills Directory

[COMMAND_EXECUTION]: The skill procedure involves executing shell commands such as pdftotext -layout <pdf> - and calling other extractors like marker and docling. These commands operate on user-provided PDF file paths. If the agent does not correctly sanitize or escape these paths, a maliciously crafted filename could lead to command injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest text and layout information from external PDF files, which is a significant attack surface for indirect prompt injection. A malicious PDF could contain hidden instructions that, when extracted and processed, attempt to subvert the agent's safety protocols or perform unauthorized actions. * Ingestion points: Processes content from external PDF files (SKILL.md). * Boundary markers: The instructions lack markers or specific guidelines to treat the extracted text as untrusted data or to ignore embedded instructions. * Capability inventory: The skill has file system read/write access and shell command execution capabilities (SKILL.md). * Sanitization: No sanitization, filtering, or validation of the extracted PDF content is specified before it is incorporated into the agent's context.

pdf-to-markdown