The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill is designed to ingest and process untrusted external data (PDF files). It provides the agent with significant capabilities including writing new files and executing shell commands (e.g., qpdf, pdftk). There are no boundary markers or sanitization procedures described to prevent malicious instructions embedded within a PDF (via text, metadata, or OCR'd content) from influencing the agent's logic or command usage.
Ingestion points: PDF files processed via pypdf (in scripts/extract_form_field_info.py) and pdfplumber (in SKILL.md).
Boundary markers: None provided in the instructions or scripts.
Capability inventory: File modification/creation (pypdf, reportlab) and shell command execution (qpdf, pdftotext, pdftk).
Sanitization: None detected for extracted PDF content.
[Dynamic Execution] (MEDIUM): The script scripts/fill_fillable_fields.py performs runtime monkeypatching of the pypdf library (DictionaryObject.get_inherited). While intended to resolve a library bug, dynamic modification of imported modules increases the risk of unexpected behavior or exploitation.
[Command Execution] (MEDIUM): SKILL.md explicitly instructs the agent to use powerful command-line utilities like qpdf (including decryption commands) and pdftk. This capability, when paired with the ingestion of untrusted PDFs, presents a high risk if the agent is tricked into running commands with malicious arguments derived from document content.

pdf