The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PDF documents through various extraction tools such as pypdf, pdfplumber, pdftotext, and pytesseract, creating a surface for indirect prompt injection.
Ingestion points: PDF files are read and processed across multiple scripts including scripts/extract_form_field_info.py, scripts/fill_fillable_fields.py, and scripts/convert_pdf_to_images.py.
Boundary markers: The instructions in forms.md and SKILL.md do not include explicit prompt boundary markers or directives to ignore instructions embedded within the extracted text.
Capability inventory: The skill has the ability to read and write files, execute shell commands (via tools like qpdf and pdftotext), and generate images.
Sanitization: There is no evidence of sanitization or filtering of the content extracted from PDFs before it is presented to the agent.
[DYNAMIC_EXECUTION]: The script scripts/fill_fillable_fields.py performs runtime monkeypatching of a third-party library to modify its behavior.
Evidence: The function monkeypatch_pydpf_method() dynamically replaces pypdf.generic.DictionaryObject.get_inherited with a custom implementation. While this is used to work around a specific bug in pypdf version 5.7.0, it constitutes dynamic modification of executable code at runtime.

pdf