The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides tools like ingest_documents and parse_pdf_structure that accept absolute file paths as input.
This allows the agent to access and attempt to read files from the local filesystem.
There is a risk of data exposure if the agent is directed to ingest sensitive non-PDF files (e.g., credentials, configuration files), which might leak metadata or content fragments into the conversation history.
[PROMPT_INJECTION]: The skill processes untrusted data from external PDF documents, creating a surface for indirect prompt injection.
Ingestion points: Data enters the agent context through automated PDF extraction tools (ingest_documents, fetch_document_asset) and dynamic resources (document://).
Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" warnings for the agent when it receives the extracted text.
Capability inventory: The skill possesses the capability to read local files and query structured knowledge bases across documents.
Sanitization: There is no evidence of sanitization or filtering of the extracted PDF text before it is presented to the agent.
An attacker could craft a malicious PDF containing hidden instructions (e.g., in metadata, white text, or comments) designed to hijack the agent's behavior when the document is analyzed.

pdf-asset-extractor