The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to download and parse external PDF files from arbitrary URLs, which creates a significant surface for indirect prompt injection. A malicious PDF could contain hidden instructions designed to manipulate the agent's logic once the extracted text is processed.
Ingestion points: The scripts/extract_specs.py script downloads content from remote URLs via the --url argument and reads local files via the --file argument.
Boundary markers: The skill lacks explicit instructions or delimiters to warn the agent to ignore potentially malicious commands embedded within the extracted datasheet text.
Capability inventory: The skill possesses file-read and network-fetch capabilities through its Python extraction script.
Sanitization: There is no evidence of text sanitization or filtering to remove potential instruction-like patterns from the PDF content before it is returned to the agent.
[EXTERNAL_DOWNLOADS]: The scripts/extract_specs.py utility fetches datasheet files from remote servers. While the examples provided (SparkFun and Adafruit) are well-known services in the electronics industry, the tool's ability to fetch from any user-defined URL is an inherent part of its operation.

datasheet-interpreter