The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill functions as an ingestion point for untrusted binary documents (PDF and DOCX) which may contain malicious instructions (e.g., hidden text, metadata, or comments) designed to compromise the agent. This risk is managed through explicit guardrails in the safety model and a mandatory summarization and redaction workflow.
Ingestion points: scripts/convert_to_markdown.py reads user-provided document files from the local filesystem.
Boundary markers: references/safety.md identifies all document content as untrusted evidence and explicitly forbids the agent from following commands found within the documents.
Capability inventory: The skill utilizes subprocess.run for external tool execution (pdftotext, pip) and performs extensive filesystem operations to write converted artifacts and assets.
Sanitization: references/summarization-policy.md requires the agent to inspect, classify, and redact content into a separate staging area before any information is promoted to a versionable summary.
[EXTERNAL_DOWNLOADS]: When the --install-missing flag is utilized, the skill's Python script makes network requests to the official Python Package Index (PyPI) to download and upgrade libraries such as pypdf, pdfplumber, and PyMuPDF.
[DYNAMIC_EXECUTION]: The skill manages a local Python virtual environment at runtime, installing dependencies as needed and dynamically modifying sys.path to load them. While used for established libraries, this mechanism allows for the execution of code downloaded at runtime.
[COMMAND_EXECUTION]: The skill routinely executes external commands using subprocess.run. This includes calling the system pdftotext utility for PDF extraction and the pip module for dependency management. These calls use sanitized paths and argument lists to prevent shell injection.

krt-document-forge