The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes PDF files which are considered untrusted external data. This creates a surface for indirect prompt injection if the PDF content contains malicious instructions that the agent might inadvertently follow.
Ingestion points: PDF files are ingested using libraries like pypdf, pdfplumber, and pdf2image within scripts such as extract_form_field_info.py and extract_form_structure.py.
Boundary markers: None identified. The instructions do not define clear boundaries or provide warnings to the agent to ignore embedded instructions within PDF data.
Capability inventory: The skill has the capability to write to the file system, modify PDF files, and execute command-line tools (e.g., qpdf, pdftotext, pdftk).
Sanitization: None identified. Extracted content is processed without filtering for potentially malicious agent instructions.
[COMMAND_EXECUTION]: The skill instructions guide the agent to perform operations using shell commands including qpdf, pdftotext, and pdftk. While functional, this represents a capability that could be misused if filenames or arguments derived from untrusted sources are not carefully handled.
[EXTERNAL_DOWNLOADS]: The skill references several external libraries from well-known registries, such as pypdf, pdfplumber, and reportlab. These are standard dependencies for PDF processing and do not originate from untrusted sources.
[REMOTE_CODE_EXECUTION]: The fill_fillable_fields.py script performs dynamic code modification by monkeypatching the DictionaryObject.get_inherited method of the pypdf library. This is used to handle specific field attribute logic at runtime.

pdf