The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of content from external PDF documents, which serves as a potential vector for indirect prompt injection.
Ingestion points: The scripts/extract.py utility extracts textual and tabular data from user-supplied PDF files.
Boundary markers: There are no explicit instructions or mechanisms provided to wrap the extracted content in delimiters that would signal to the agent that the data is untrusted.
Capability inventory: The skill environment allows for Python execution (execute_code) and file operations, providing a potential exploitation path if instructions within a PDF are followed.
Sanitization: The implementation lacks sanitization or filtering to mitigate the impact of malicious instructions embedded in the PDF text layer.

pdf-toolkit