The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted PDF documents, creating a surface for indirect prompt injection where malicious content within a document could attempt to influence the agent's behavior.
Ingestion points: scripts/liteparse_to_md.py and scripts/ocr_api_job.py read user-provided PDF files.
Boundary markers: Absent. The skill does not use delimiters to isolate document content from instructions.
Capability inventory: The skill can execute curl commands via subprocess.run and write files to the local system.
Sanitization: Absent. The extracted text is not sanitized to remove potential injection patterns.
[COMMAND_EXECUTION]: The script scripts/ocr_api_job.py securely invokes the curl binary using subprocess.run with argument lists, effectively preventing shell injection vulnerabilities.
[DATA_EXFILTRATION]: The skill is designed to upload documents to remote OCR services. This risk is mitigated by requiring an explicit --allow-remote flag for non-local destinations and defaulting to a local service address (127.0.0.1).
[EXTERNAL_DOWNLOADS]: Several scripts specify external Python dependencies (liteparse, pypdfium2, pillow) using standard inline metadata (PEP 723), which are fetched from well-known package registries during execution.

pdf-to-md