The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from external PDF files, creating an attack surface for indirect prompt injection. A malicious PDF could contain hidden instructions designed to manipulate the agent's behavior during text extraction, OCR, or form analysis.
Ingestion points: PDF files are ingested in SKILL.md (using pypdf and pdfplumber), FORMS.md (via scripts/check_fillable_fields.py, scripts/extract_form_field_info.py, and scripts/extract_form_structure.py), and REFERENCE.md (via pypdfium2, pdf-lib, and pdfjs-dist).
Boundary markers: The instructions do not define delimiters or provide warnings to the agent to ignore instructions embedded within the processed document content.
Capability inventory: The skill allows for writing files to the local system (SKILL.md, scripts/fill_fillable_fields.py) and executing shell commands for document manipulation (SKILL.md, FORMS.md, REFERENCE.md).
Sanitization: There is no evidence of text sanitization or filtering of external content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill instructs the agent to execute various command-line tools for PDF processing and image manipulation, including pdftotext, qpdf, pdftk, pdftoppm, pdfimages, and magick (ImageMagick).
[METADATA_POISONING]: There is a discrepancy between the skill author listed in the YAML frontmatter (lev-os) and the copyright holder listed in LICENSE.txt (Anthropic, PBC). While potentially a template error, inconsistent metadata can be misleading regarding the skill's origin.

pdf