The Agent Skills Directory

[SAFE]: The skill provides standard documentation and code snippets for document processing. No malicious instructions, obfuscation, or unauthorized access patterns were detected.- [EXTERNAL_DOWNLOADS]: Dependencies such as pypdf, pdfplumber, and docling are well-known libraries in the document processing ecosystem. The instructions correctly note that local OCR engines may download model weights and identify the licensing implications of AGPL software.- [COMMAND_EXECUTION]: The scripts/verify.sh file is a development tool for static analysis. It uses standard shell commands (grep, awk) to lint the skill's content without executing the code snippets or initiating network connections.- [CREDENTIALS_UNSAFE]: The skill follows security best practices by instructing the use of environment variables for API keys rather than hardcoding them in the scripts.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external document data, which is an inherent attack surface for indirect prompt injection. However, it includes mitigations such as boundary separation instructions and recommendations for human verification of OCR output.

document-processing