The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external documents (PDF, PPTX) and images through vision models, creating an attack surface for indirect prompt injection where malicious instructions in the content could attempt to hijack model behavior. 1. Ingestion points: The src argument in scripts/transcribe_pages.py accepts external files. 2. Boundary markers: The vision prompt lacks explicit markers to distinguish instructions from untrusted content. 3. Capability inventory: The skill can execute local subprocesses and call vision model APIs. 4. Sanitization: No sanitization is performed on visual or text inputs.
[COMMAND_EXECUTION]: scripts/transcribe_pages.py executes local system tools including libreoffice, pdftoppm, and tesseract. While it correctly uses argument lists to prevent shell injection, it still performs operations based on user-provided file paths.
[DYNAMIC_EXECUTION]: The script scripts/transcribe_pages.py dynamically modifies the system path to import modules from other skill directories such as browsing-bluesky and invoking-gemini. Although these are hardcoded internal paths, this represents dynamic loading of code outside the skill's own directory.

transcribing-images