The Agent Skills Directory

Prompt Injection (HIGH): The forms.md file contains strong instructional overrides such as 'CRITICAL: You MUST complete these steps in order. Do not skip ahead to writing code.' and 'Follow the below steps exactly.' These patterns are designed to bypass the agent's normal decision-making and planning processes.
Indirect Prompt Injection (HIGH): The skill provides a significant attack surface for indirect prompt injection by processing untrusted PDF documents.
Ingestion points: scripts/extract_form_field_info.py and scripts/fill_fillable_fields.py ingest arbitrary data from PDF form fields (IDs and values).
Boundary markers: There are no boundary markers or instructions to the agent to ignore embedded commands in the extracted PDF data.
Capability inventory: The skill has extensive file-write capabilities across multiple scripts, including scripts/fill_fillable_fields.py and scripts/fill_pdf_form_with_annotations.py.
Sanitization: No sanitization or escaping is performed on the extracted PDF metadata or field content before it is processed by the agent or written back to files.
Dynamic Execution (MEDIUM): The script scripts/fill_fillable_fields.py implements a runtime monkeypatch of the pypdf library's DictionaryObject.get_inherited method. While documented as a bug fix, runtime modification of executable library code is a risky pattern that can be exploited to alter program flow or hide malicious behavior.
External Downloads (LOW): SKILL.md and forms.md provide instructions to install external dependencies like pytesseract and pdf2image and suggest using command-line tools like poppler-utils and qpdf. While these are well-known tools, they increase the overall attack surface of the environment.

pdf