The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for Indirect Prompt Injection as it is designed to ingest and process untrusted external content (PDFs, HTML, DOCX, and images) from both local paths and URLs.
Ingestion points: Document inputs processed via the docling CLI and Python API as described in SKILL.md.
Boundary markers: Absent; the instructions do not specify using delimiters or "ignore embedded instructions" warnings when handling document text.
Capability inventory: The skill has access to shell execution (Bash for docling, uv, and python) which could be influenced if an ingested document contains malicious instructions that the agent follows during the analysis phase.
Sanitization: No sanitization or validation of the document content is performed before it is presented to the agent's context.
[COMMAND_EXECUTION]: The skill frequently uses shell commands to perform its primary functions, including document conversion via the docling CLI and running a local evaluation script.
Evidence: SKILL.md and README.md provide numerous examples of executing docling and uv run scripts/docling-evaluate.py.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of external software and data.
Evidence: Instructions include uv tool install docling and uv add 'docling-core[chunking-openai]' to fetch packages from public registries. The VLM pipelines may also trigger the download of model weights from Hugging Face or other repositories during initial execution.
[PROMPT_INJECTION]: The skill metadata contains a potential inconsistency that could be classified as metadata poisoning.
Evidence: The author field in the SKILL.md frontmatter is set to docling-project, which contradicts the provided skill author jr2804. This could lead a user to believe the skill is an official distribution from the Docling project when it may be a third-party implementation or a template-derived version.

docling-document-intelligence