The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted document images and PDFs through its MCP tools and returns structured text results to the agent. It lacks boundary markers or explicit warnings to ignore embedded instructions for the agent, creating a surface for indirect prompt injection where malicious text inside a document could influence agent behavior. \n- Ingestion points: mcp_ocr_server.py (ocr_image, ocr_pdf, kie_image, vqa_image tools). \n- Boundary markers: Absent. \n- Capability inventory: Includes network read (urllib.request.urlopen) and local file read (Path.read_bytes). \n- Sanitization: Input formats are validated by parsing libraries, but extracted text is not sanitized for instructions. \n- [DATA_EXFILTRATION]: The _read_bytes function in mcp_ocr_server.py fetches remote images via a user-supplied URL without hostname restrictions, which could be exploited for Server-Side Request Forgery (SSRF). \n- [DATA_EXFILTRATION]: The MCP tools accept an image_path parameter which allows the process to read any local file accessible to it. While intended for processing local documents, this could be misused to access sensitive information if the agent is misled. \n- [COMMAND_EXECUTION]: The skill includes several Python and Shell scripts (install.sh, e2e_img2md.py, twostage_img2md.py) that use subprocess to manage local model servers and set up the Python environment. These are restricted to administrative tasks related to the skill deployment. \n- [EXTERNAL_DOWNLOADS]: The installation process fetches Python dependencies from PyPI and model weights from well-known services like Hugging Face and Ollama. It also references an evaluation Docker image on GitHub Container Registry. \n- [PERSISTENCE]: The installation script register_codex_mcp.py modifies the local configuration file for the Codex agent to register the MCP server.

xiaomi-ocr-setup