The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PDF data from local paths or remote URLs which serves as an ingestion point for indirect prompt injection attacks.
Ingestion points: PDFs are downloaded from user-provided URLs as described in SKILL.md or read from local paths using the scripts/extract.py utility.
Boundary markers: The skill lacks explicit instructions for the agent to treat the extracted PDF content as untrusted data or use delimiters to prevent content from being interpreted as instructions.
Capability inventory: The agent has access to shell execution (curl, pdftotext, pdfinfo, tesseract), file read/write permissions (specifically in the /tmp/ directory), and python execution via the provided scripts/extract.py script.
Sanitization: No sanitization, escaping, or filtering is performed on the text extracted from the PDF before it is presented to the agent's context.
[EXTERNAL_DOWNLOADS]: The skill explicitly instructs the agent to download PDF files from arbitrary URLs using curl to the /tmp/ directory for subsequent processing.
[COMMAND_EXECUTION]: The skill relies on executing multiple external CLI tools including pdftotext, pdfinfo, pdfimages, pdffonts, and tesseract to perform its primary functions, which is expected for the stated purpose but represents a tool-based execution surface.

pdf-reader