The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill processes untrusted PDF files that may contain malicious instructions designed to hijack the agent's workflow.
Ingestion points: PDF text and structure are extracted using pypdf and pdfplumber (e.g., in scripts/extract_form_field_info.py).
Boundary markers: None. The agent is not instructed to isolate or sanitize extracted content.
Capability inventory: The skill can write files to disk, including generated PDFs (PdfWriter.write), PNG images (Image.save), and JSON metadata.
Sanitization: No validation or escaping is applied to extracted data before it influences agent logic or file creation.
[Dynamic Execution] (MEDIUM): scripts/fill_fillable_fields.py contains a monkeypatch_pydpf_method function that modifies the pypdf library at runtime. This practice of altering third-party library internals is fragile and can be exploited to hide malicious behavior or bypass intended security boundaries.
[Unverifiable Dependencies & Remote Code Execution] (LOW): The skill requires several external libraries (pypdf, pdfplumber, reportlab, pandas, pytesseract, pdf2image, Pillow). These represent an expanded attack surface and are not pinned to specific versions, which is a best-practice violation.

pdf