The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and parse documents from external and potentially untrusted sources, which creates a vulnerability surface for indirect prompt injection attacks where malicious instructions hidden in documents could manipulate the agent.
Ingestion points: The skill accepts document inputs from local file paths and arbitrary URLs through the CLI (SKILL.md, references/cli.md) and the Python SDK (references/python-sdk.md).
Boundary markers: There are no specific boundary markers or "ignore embedded instructions" guidelines mentioned in the provided documentation to help the agent distinguish between document content and system instructions.
Capability inventory: The skill's environment allows for broad command execution capabilities via Bash (including python, pip, and uv), which could be exploited if an agent is successfully subverted via a malicious document.
Sanitization: No sanitization or content filtering mechanisms for extracted text are described in the documentation.
[EXTERNAL_DOWNLOADS]: The skill relies on external package registries and model repositories to function.
It installs the docling library and its ecosystem (e.g., docling-core, docling-slim, and framework integrations like langchain-docling) from PyPI using pip and uv (references/slim-packaging.md, references/rag.md).
It downloads machine learning model artifacts (e.g., for OCR and layout analysis) from Hugging Face or user-defined paths using the docling-tools models download command (references/cli.md, references/python-sdk.md).
It supports offloading processing to remote service endpoints or vision-language model APIs, which involves transmitting document data to external URLs (references/service-client.md, references/python-sdk.md).

docling