The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it is designed to ingest and process data from untrusted PDF documents.
Ingestion points: The scripts extract_form_field_info.py, fill_fillable_fields.py, and pdfplumber examples in SKILL.md read and analyze content directly from PDF files provided by users.
Boundary markers: The instructions in forms.md do not include explicit warnings or delimiters to help the agent distinguish between its instructions and potentially malicious instructions embedded within the PDF text or metadata.
Capability inventory: The skill possesses extensive capabilities, including reading/writing local files and executing shell commands (e.g., qpdf, pdftotext), which could be leveraged if an injection is successful.
Sanitization: There is no evidence of content sanitization or validation to filter out potential instructions from the PDF content before it is presented to the agent.
[COMMAND_EXECUTION]: The skill relies on the execution of multiple local Python scripts and external command-line utilities.
SKILL.md and reference.md instruct the agent to use CLI tools such as qpdf, pdftotext, pdftk, and pdfimages for document manipulation.
The skill includes several helper scripts (e.g., scripts/convert_pdf_to_images.py, scripts/fill_pdf_form_with_annotations.py) that the agent is expected to run to perform its tasks.
[REMOTE_CODE_EXECUTION]: The script fill_fillable_fields.py performs dynamic modification of a third-party library at runtime.
The function monkeypatch_pydpf_method overrides pypdf.generic.DictionaryObject.get_inherited to fix a specific bug in the pypdf library's handling of selection lists. While this logic is static and intended for compatibility, it represents dynamic execution behavior.

pdf