The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/md_to_epub.py utilizes subprocess.run to execute the pandoc command-line tool. This is a legitimate operation required for converting Markdown files to EPUB format. The command is constructed using a list of arguments, which is a secure practice that prevents shell command injection.
[DYNAMIC_EXECUTION]: The script scripts/extract.py contains a helper function _importable that uses __import__ to check for the presence of optional dependencies such as pypandoc and ebooklib. The module names are hardcoded in the script, posing no risk of arbitrary code execution.
[EXTERNAL_DOWNLOADS]: The SKILL.md instructions recommend installing standard, reputable packages (e.g., pymupdf, pypandoc-binary, ebooklib) using official package managers like pip, brew, or winget to support the skill's functionality. These are standard development dependencies.
[PROMPT_INJECTION]: The skill processes external data (PDF images) through a vision-capable sub-agent. While this presents an indirect prompt injection surface where instructions could be embedded in the images, the skill provides strict instructional boundaries in references/subagent_prompt.md. These instructions mandate that the agent only outputs verbatim recognized text and disregards non-document content, mitigating the risk of the agent following instructions found within the scanned documents.

scanned-pdf-to-epub