The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill's primary function is to ingest and process untrusted PDF documents through various extraction tools. This creates a significant attack surface where malicious instructions embedded in PDFs (text or metadata) can influence the agent's behavior.
Ingestion points: The skill utilizes pypdf, pdfplumber, and pytesseract (OCR) to extract content from external PDF files provided at runtime.
Boundary markers: No boundary markers or 'ignore embedded instructions' prompts are implemented to differentiate between the PDF's data and the agent's instructions.
Capability inventory: The skill possesses extensive capabilities, including file system writes (creating new PDFs and images), and the execution of complex shell commands via qpdf, pdftk, and pdftotext.
Sanitization: There is no evidence of sanitization or filtering for extracted text before it is returned to the agent context.
Dynamic Execution (MEDIUM): The script scripts/fill_fillable_fields.py implements a runtime monkeypatch of the pypdf library.
Evidence: The function monkeypatch_pydpf_method redefines DictionaryObject.get_inherited at runtime. While the intent is to fix a bug in the upstream library, runtime class modification is a dangerous pattern that can lead to instability or be leveraged in more complex exploit chains.
Command Execution (LOW): The skill relies heavily on calling external binaries (qpdf, pdftk, pdftotext). While used for their intended purpose, the construction of these commands often involves interpolating file paths or user-provided arguments, which requires careful handling to prevent shell injection.

pdf