The Agent Skills Directory

[PROMPT_INJECTION]: The skill exposes the agent to indirect prompt injection by parsing untrusted document content from various file formats and URLs.
Ingestion points: The docling CLI and Python API usage described in SKILL.md accept arbitrary local paths and remote URLs as input for parsing.
Boundary markers: Absent. There are no instructions in SKILL.md to wrap extracted content in delimiters or to ignore embedded instructions found within the documents.
Capability inventory: The skill utilizes Bash for executing docling, python3, and pip commands, providing a significant capability surface if the agent is manipulated by document content.
Sanitization: Absent. Content extracted by the tool is passed directly to the agent in Markdown or JSON format without filtering for malicious prompt instructions.
[DATA_EXFILTRATION]: The skill performs network operations to fetch document content from non-whitelisted domains as part of its primary functionality.
Evidence: SKILL.md and README.md provide examples of fetching documents from URLs (e.g., docling https://arxiv.org/pdf/2408.09869). While this is the intended purpose, it involves outbound network calls to external sites.

docling-document-intelligence