The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to parse and convert untrusted external documents (PDF, DOCX, HTML, etc.) from local paths or remote URLs. This content is then provided to the agent in Markdown or JSON format, creating a surface for indirect prompt injection where malicious instructions embedded in a document could influence the agent's behavior.\n
Ingestion points: The docling CLI and Python DocumentConverter accept arbitrary sources, including public URLs.\n
Boundary markers: The documentation does not specify the use of delimiters or 'ignore' instructions to prevent the agent from following commands embedded in the converted document content.\n
Capability inventory: The skill has access to powerful tools like Bash, python, and pip, which increases the potential impact of a successful injection.\n
Sanitization: No specific sanitization or filtering of the extracted content for malicious instructions is described.\n- [DYNAMIC_EXECUTION]: The skill allows for the dynamic loading and execution of code from remote model repositories when using certain VLM models (e.g., nemotron_parse_v3_5). This behavior is gated by the --trust-remote-code flag in the CLI and the trust_remote_code option in the Python SDK.\n
Evidence: In references/cli.md and references/python-sdk.md, the documentation explains that specific models run code from their respective repositories and require explicit user consent via the trust-remote-code setting. This mechanism could be exploited if an attacker provides a malicious model name or repository.\n- [REMOTE_CODE_EXECUTION]: By enabling the execution of remote model code, the skill provides a pathway for remote code execution. While this is an opt-in feature for specialized ML tasks, it represents a significant security risk if the source repository is compromised or spoofed.\n- [COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to run the docling CLI and other related tools (uv, pip, python). This provides the agent with the ability to execute system-level commands to perform document processing tasks.

docling