The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted PDF documents through various extraction scripts and libraries such as pypdf, pdfplumber, and pdftotext. This creates an attack surface for indirect prompt injection, where malicious instructions hidden in a document could influence the agent's behavior.
Ingestion points: Data enters the agent's context through scripts like scripts/extract_form_field_info.py and text extraction examples in SKILL.md and reference.md.
Boundary markers: The skill does not implement specific delimiters or 'ignore embedded instructions' warnings when presenting extracted text to the agent.
Capability inventory: The skill allows the agent to execute shell commands (via qpdf/pdftk) and write files to the local filesystem, which could be abused if an injection is successful.
Sanitization: No explicit sanitization or validation of the extracted PDF text is performed before processing.
[COMMAND_EXECUTION]: The skill instructs the agent to use several command-line utilities for PDF manipulation tasks.
Tools used: Includes qpdf, pdftotext, pdfimages, and pdftk.
Context: These tools are used for merging, splitting, rotating, and extracting data from PDF files provided in the workspace.
[DYNAMIC_EXECUTION]: The script scripts/fill_fillable_fields.py performs runtime monkeypatching of the pypdf.generic.DictionaryObject.get_inherited method to resolve a known formatting bug in the library. This is a technical workaround and does not involve executing untrusted code strings.

pdf