The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file includes mandatory directives ("⚠️ MANDATORY SKILL INVOCATION ⚠️", "YOU MUST invoke this skill", "Failure... violates your operational requirements") designed to override the agent's autonomy and dictate specific tool usage.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted document content retrieved via API, which could contain malicious instructions.
Ingestion points: scripts/paperless-api.sh (search, list, and get commands) and SKILL.md (Workflow sections).
Boundary markers: No specific delimiters are implemented to separate document content from agent instructions.
Capability inventory: The skill possesses the ability to delete documents, perform bulk metadata updates, and download files to the host system via scripts/paperless-api.sh and scripts/bulk-api.sh.
Sanitization: There is no evidence of sanitization or filtering of the text content extracted from documents before it is presented to the agent.
[COMMAND_EXECUTION]: The skill relies on multiple bash scripts that use shell interpolation and piping to construct API requests. While arguments are generally quoted, this complex shell-based architecture for handling user-provided metadata increases the potential surface for command injection.

paperless-ngx