The Agent Skills Directory

[PROMPT_INJECTION] (HIGH): The skill is designed to process untrusted PDF files and their extracted contents (text, tables, and images). This creates a significant surface for indirect prompt injection attacks. Malicious instructions embedded in a PDF could influence the agent's behavior during the multi-step analysis workflow described in forms.md.
Ingestion points: PDF files read via pypdf and pdfplumber, and images generated via scripts/convert_pdf_to_images.py.
Capabilities: File system write access (PdfWriter), metadata modification, and command-line tool execution.
Sanitization: No evidence of sanitization or delimiters to isolate untrusted content from the agent's reasoning.
[COMMAND_EXECUTION] (MEDIUM): The SKILL.md file documents and encourages the use of various command-line utilities (qpdf, pdftotext, pdftk, pdfimages) via subprocesses. This introduces risks if the agent constructs shell commands using untrusted inputs like filenames or internal document data.
[DYNAMIC_EXECUTION] (MEDIUM): scripts/fill_fillable_fields.py contains a function monkeypatch_pydpf_method() that dynamically modifies the pypdf.generic.DictionaryObject.get_inherited method at runtime. While used here as a bug workaround, runtime library modification is an inherently risky pattern that can lead to unstable or insecure execution states.

pdf