The Agent Skills Directory

[DATA_EXFILTRATION]: The skill uses a library function _load_file_as_base64 in scripts/lib.py to read local files and encode them for transmission to a remote API. While this is core functionality for document parsing, the lack of path restrictions allows the agent to potentially access and transmit sensitive system files if a malicious path is provided to the --file-path argument.
[INDIRECT_PROMPT_INJECTION]: The skill processes content from untrusted external documents (PDFs and images). The instructions in SKILL.md explicitly mandate that the agent must display the "COMPLETE extracted content" and "NOT truncate or summarize." This creates a significant surface for indirect prompt injection attacks where malicious instructions hidden within a document could be executed by the agent upon processing.
Ingestion points: Document text is ingested via the text and result[n].markdown fields returned by scripts/vl_caller.py.
Boundary markers: None identified; instructions specifically discourage filtering or summarizing content.
Capability inventory: The skill can execute Python scripts and perform network operations using the PADDLEOCR_ACCESS_TOKEN.
Sanitization: No sanitization or filtering is performed on the extracted text before it is presented to the agent's context.
[COMMAND_EXECUTION]: The skill relies on executing the scripts/vl_caller.py script to perform its primary function. While these scripts are internal to the skill, they represent the primary interface through which the agent interacts with the local file system and network.

paddleocr-doc-parsing