The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest and process content from untrusted external PDF files and JSON configuration files.\n
Ingestion points: PDF content is read via scripts/profile.py (metadata), scripts/form.py (form fields), and various recipes in references/recipes.md (text and table extraction).\n
Boundary markers: The instructions lack explicit boundary markers or delimiters to isolate extracted content from the agent's control stream.\n
Capability inventory: The agent has the capability to read/write local files and execute shell commands via the provided scripts.\n
Sanitization: While the scripts produce structured JSON, there is no evidence of specific sanitization of the document text to prevent embedded instructions from influencing the agent.\n- [REMOTE_CODE_EXECUTION]: A documentation recipe in references/recipes.md uses a Python heredoc to dynamically execute a script for table extraction using the pdfplumber library. This is a form of dynamic script generation from a fixed template, which is generally acceptable but represents a dynamic execution pattern.\n- [COMMAND_EXECUTION]: The skill's Python scripts and documentation recipes execute several local shell commands (e.g., qpdf, pdftotext, pdfinfo, pdfimages, ocrmypdf). These executions are implemented using safe patterns, such as list-based arguments for subprocess.run(), and target well-known utility binaries.\n- [EXTERNAL_DOWNLOADS]: The skill uses the uv package manager to dynamically install Python dependencies (pypdf, reportlab, pdfplumber) from official registries. These are well-known libraries and the versions are specified, representing standard package management behavior.

pdf