The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill is highly susceptible to indirect prompt injection as its core function is to ingest and analyze untrusted external PDF files.
Ingestion points: Data enters the agent context via SKILL.md (using pypdf, pdfplumber), scripts/extract_form_field_info.py, and scripts/convert_pdf_to_images.py.
Boundary markers: Absent. There are no delimiters or instructions to ignore embedded commands within the processed PDF content.
Capability inventory: The skill allows for local file creation (scripts/create_validation_image.py, scripts/fill_fillable_fields.py), OCR via pytesseract, and encourages the use of powerful CLI tools like qpdf and pdftk through subprocess calls.
Sanitization: Absent. Content is parsed and interpreted directly from the PDF structure.
[Dynamic Execution] (MEDIUM): The script scripts/fill_fillable_fields.py performs a runtime monkeypatch of the pypdf library.
Evidence: The function monkeypatch_pydpf_method reassigns pypdf.generic.DictionaryObject.get_inherited to a local wrapper function at runtime. This practice can be used to hide malicious logic or lead to unstable behavior by modifying third-party library internals.
[Command Execution] (MEDIUM): SKILL.md provides explicit instructions for the agent to execute shell commands using qpdf, pdftotext, pdftk, and pdfimages. While these are legitimate tools, the potential for command injection exists if the agent interpolates unsanitized filenames or parameters into these shell strings.

pdf