The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions specify the installation of poppler via Homebrew and utilize uvx to download and run noteshrink, a well-known open-source utility for whitening document backgrounds. These are legitimate tools for the skill's stated purpose.
[COMMAND_EXECUTION]: Several Python scripts included with the skill (make_contact_sheet.py, synthesize_signature.py) use the subprocess.run function to invoke system utilities like pdftoppm, fc-list, and pdftotext. The analysis confirms these calls use argument lists rather than raw shell strings, which effectively prevents shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as user-provided photographs and PDF documents. It incorporates mandatory visual verification steps (contact sheets) for the agent to verify the output, which serves as a manual guardrail against processing errors or data-driven instruction confusion.

photo-to-scanned-pdf