The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/verify_render.py script searches for and executes a local Google Chrome or Chromium binary using subprocess.run to perform headless rendering of the generated HTML, creating screenshots for visual verification.
[EXTERNAL_DOWNLOADS]: The skill utilizes the uv package manager to fetch and run standard Python libraries including pymupdf, Pillow, and numpy at runtime.
[SAFE]: The HTML generation logic in scripts/build_html.py correctly uses html.escape() to sanitize text blocks and image metadata extracted from the source PDF, mitigating potential injection risks in the rendered HTML output.
[SAFE]: An assessment of the Indirect Prompt Injection (Category 8) attack surface was performed: 1. Ingestion points: External PDF content processed by scripts/extract_pdf.py; 2. Boundary markers: No explicit delimiters are used for extracted PDF text; 3. Capability inventory: File system writes and subprocess.run for headless browser execution; 4. Sanitization: All extracted text is sanitized via html.escape() before being interpolated into the HTML structure. The potential risk is mitigated by the conversion to static HTML and proper escaping.

pdf-to-html