The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/docling_convert_html_with_figures.py and scripts/docling_convert_pdf.py execute system commands (curl and docling) via the subprocess module. These calls pass user-supplied inputs (URLs, file paths, and additional arguments) as command-line parameters. This creates a risk of argument injection; if an input starts with a hyphen -, it could be interpreted as a command flag rather than a positional argument, potentially allowing an attacker to manipulate the behavior of curl or docling (e.g., writing to arbitrary files or exfiltrating data).
[EXTERNAL_DOWNLOADS]: The skill uses curl to fetch content from external URLs. While this is necessary for its function as an ingestion tool, it allows the agent to interact with arbitrary remote servers, which could be used to fetch malicious payloads or access internal network resources if the URLs are not validated.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to ingest and process external content such as PDFs, Office documents, and web pages. This content is converted to Markdown for agent review, creating a large surface for indirect prompt injection. Maliciously crafted documents could contain instructions aimed at subverting the agent's behavior during the conversion or integration phases.
Ingestion points: Ingests content from arbitrary URLs and local files (PDF, HTML, Docx, etc.) in scripts/docling_convert_html_with_figures.py and scripts/docling_convert_pdf.py.
Boundary markers: No explicit instructions or delimiters are used to warn the agent about potentially malicious instructions embedded in the ingested content.
Capability inventory: The skill can execute shell commands via subprocess, read/write files in the sources/ directory, and perform network requests.
Sanitization: The conversion process normalizes content to Markdown but does not include sanitization or filtering to remove potential prompt injection payloads from the text.
[DYNAMIC_EXECUTION]: The ingestion scripts allow for 'extra' arguments to be passed directly to the docling conversion tool via sys.argv. This allows for dynamic control over the execution parameters of a third-party tool, which increases the risk of misconfiguration or exploitation if the arguments are influenced by untrusted input.

kb-ingest