The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it extracts text from untrusted external sources (images or image URLs) and provides this text to the agent's context without sanitization. An attacker could embed malicious instructions within an image that the agent might subsequently follow if it interprets the OCR output as authoritative commands.
Ingestion points: scripts/ocr.js accepts user-provided image paths or URLs.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the OCR results as untrusted data.
Capability inventory: The skill environment allows shell command execution and file system access.
Sanitization: There is no filtering or validation of the text extracted by the OCR engine before it is returned to the agent.
[EXTERNAL_DOWNLOADS]: The skill setup instructions involve downloading the tesseract.js package from the public npm registry. Additionally, the tool can be configured to fetch image files from any remote HTTPS URL at runtime.
[DATA_EXFILTRATION]: The OCR functionality could potentially be abused to expose the contents of sensitive local files. If the agent is directed to process non-image files (such as configuration files or SSH keys) as images, the Tesseract engine might extract and display recognizable text from those files, resulting in data exposure in the session logs.

tesseract-image-ocr