The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from PDF and Markdown files, which creates a surface for indirect prompt injection if the processed files contain malicious instructions.
Ingestion points: PDF content is extracted in to-markdown/scripts/lib/converter.cjs and Markdown content is loaded in to-pdf/scripts/lib/config-loader.cjs.
Boundary markers: The skill does not currently wrap extracted content in markers or provide specific instructions to the agent to disregard embedded commands.
Capability inventory: The skill can execute local sub-scripts via spawnSync in scripts/convert.cjs and has file system write permissions.
Sanitization: No content filtering or sanitization is performed on the text extracted from input documents before it is output or presented to the agent.
[COMMAND_EXECUTION]: The skill uses spawnSync in scripts/convert.cjs to route tasks to specific converters and execSync in to-pdf/scripts/lib/chrome-finder.cjs to detect system-installed Chrome/Chromium. These commands are executed without a shell and are restricted to internal paths or standard system discovery tools.
[EXTERNAL_DOWNLOADS]: As documented in SKILL.md, the md-to-pdf dependency used for Markdown-to-PDF conversion may download a Chromium binary (~150MB) if a compatible system browser is not detected. This is standard behavior for this tool and is not considered malicious.

pdf-convert