The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted documents and converts them into text for AI consumption, which creates a surface for indirect prompt injection attacks.
Ingestion points: scripts/mineru.py accepts document file paths and URLs as input.
Boundary markers: Converted Markdown output does not utilize clear delimiters or system warnings to isolate untrusted content from the rest of the agent's context.
Capability inventory: The skill possesses extensive capabilities including reading local files, writing to the filesystem (e.g., Obsidian vaults), and performing authenticated network requests to multiple external service APIs.
Sanitization: While the skill performs standard HTML and Markdown escaping for specific target platforms, it does not filter the core text content for instructions that could manipulate the AI agent.
[DYNAMIC_EXECUTION]: The skill uses dynamic import mechanisms to load its internal delivery modules and optional dependencies.
Evidence: Use of importlib.import_module in scripts/sinks/__init__.py and importlib.util in scripts/mineru.py.
Context: The loading logic is restricted to a hardcoded internal list of sink modules and recognized optional libraries. This is a standard architectural choice for a pluggable tool and does not allow for arbitrary code execution from untrusted inputs.

mineru