The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from untrusted PDF files, which represents a potential attack surface where malicious instructions embedded in documents could attempt to influence the agent's behavior during text extraction or form-filling tasks.
Ingestion points: PDF content is read using pypdf, pdfplumber, and command-line tools like pdftotext as described in SKILL.md and reference.md.
Boundary markers: While forms.md establishes a structured workflow for the agent, there are no explicit delimiters or instructions defined to isolate extracted text content from the agent's system prompts.
Capability inventory: The skill possesses capabilities to write files to the local system and execute PDF manipulation commands using qpdf, pdftk, and poppler-utils.
Sanitization: No explicit sanitization or filtering of extracted PDF content is implemented; safety relies on the underlying model's guardrails.
[COMMAND_EXECUTION]: The skill documentation and scripts facilitate the execution of several PDF-specific command-line utilities.
Evidence: SKILL.md and reference.md provide detailed instructions for using qpdf, pdftotext, pdftk, pdfimages, pdftoppm, and magick (ImageMagick). These are industry-standard tools for the skill's stated purpose of PDF manipulation.
[DYNAMIC_EXECUTION]: The script scripts/fill_fillable_fields.py performs dynamic modification of an external library at runtime.
Evidence: The monkeypatch_pydpf_method() function replaces pypdf.generic.DictionaryObject.get_inherited with a custom implementation to correctly handle PDF form field attribute inheritance. This is a targeted functional fix rather than an obfuscation or malicious execution pattern.

pdf