The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill is designed to ingest and process untrusted PDF documents. It possesses extensive capabilities to write files, modify PDFs, and convert content to images. An attacker could potentially use a specially crafted PDF to exploit parsing vulnerabilities or mislead the agent into performing incorrect actions during the multi-step form-filling process.
Ingestion points: pypdf.PdfReader (multiple scripts), pdfplumber.open (SKILL.md), convert_from_path (scripts/convert_pdf_to_images.py).
Boundary markers: Absent. The instructions do not specify how to isolate untrusted content from the agent's instructions.
Capability inventory: File writing (PdfWriter), image saving (PIL), and command-line execution (qpdf, pdftk, etc.).
Sanitization: Limited to coordinate validation in scripts/check_bounding_boxes.py; no content sanitization is present.
[Dynamic Execution] (MEDIUM): scripts/fill_fillable_fields.py performs a runtime monkeypatch on the pypdf library.
Evidence: monkeypatch_pydpf_method() replaces pypdf.generic.DictionaryObject.get_inherited with a custom implementation to fix a bug in selection list handling. Runtime modification of dependencies increases the risk of unexpected behavior or conflict with other skills.
[Command Execution] (LOW): SKILL.md and forms.md recommend the use of several CLI tools (pdftotext, qpdf, pdftk) and provide the agent with commands to run Python scripts. While standard for this domain, these tools are executed on untrusted PDF inputs.

pdf