The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to execute the pdftotext binary for layout-preserving text extraction from PDFs. It also uses a bridge script (scripts/invoke.py) to execute a vendor-specific manager utility. These executions are scoped to functional requirements and utilize validated path construction.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external PDF files which could contain untrusted instructions. Evidence chain: 1. Ingestion points: PDF text is extracted via pdftotext in scripts/rename_invoices.py. 2. Boundary markers: SKILL.md and references/manual-review.md explicitly instruct the agent to ignore conversation context and source filenames, relying solely on document evidence. 3. Capability inventory: The skill has file-renaming capabilities using Path.rename. 4. Sanitization: The sanitize_filename_value function in scripts/rename_invoices.py filters all extracted metadata to remove path traversal and invalid characters before forming filenames. Additionally, the skill mandates user confirmation before performing any write operations.
[DYNAMIC_EXECUTION]: The scripts/invoke.py script dynamically locates the vendor's manager script (kntnt.py) by scanning a pre-defined list of common installation directories in the user's home folder and executes it using uv run.

rename-invoices